veueoenns[.]yolah[.]web[.]id

On July 24, 2026, the domain veueoenns.yolah.web.id was observed to be offline but retains several indicators of malicious infrastructure. The domain resolves to 172.67.202.37, an address owned by Cloudflare (ASN 13335) located in the United States. The authoritative nameservers are arely.ns.cloudflare.com and jihoon.ns.cloudflare.com, confirming Cloudflare as the hosting provider. No SSL certificate is presented, and HTTP requests return the generic title “Default Web Site Page”.

VirusTotal records 16 of 95 scanned engines flagging the domain, and it appears on a single external blocklist. The registrar listed is PT Cloud Hosting Indonesia, and the domain was created on 29 January 2025. Gridinsoft assigns a trust score of 0/100, and PhishDestroy has already added the domain to its block list. These data points collectively suggest the site was used for a generic phishing campaign, although the specific targeted brand or credential‑stealing page has not been captured.

Because the site is currently offline, ongoing monitoring of the associated IP address and Cloudflare nameservers is recommended to detect any re‑hosting attempts. Defensive actions should include adding 172.67.202.37 to deny‑list rules, updating URL filtering to block veueoenns.yolah.web.id, and sharing the indicators with threat‑intel platforms. Analysts should continue to query VirusTotal and other sandbox services for any newly submitted samples that reference this domain, and verify whether the blocklist entry is refreshed in future scans.