yubit-qgwg[.]com

This domain, yubit-qgwg.com, is identified as an active cryptocurrency phishing site targeting wallet credentials and digital asset transfers. Analysis of the page title, 'DEVELOPMENT,' and associated infrastructure suggests the presence of a wallet drainer kit, though no specific brand impersonation is confirmed. The site employs Vue.js for frontend interactivity, a common framework in phishing campaigns to mimic legitimate wallet interfaces and facilitate credential harvesting. Infrastructure analysis reveals the domain was registered on June 08, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with malicious domains. It resolves to the IP address 172.67.176.63, hosted behind Cloudflare, which provides SSL encryption via Google Trust Services. Detection metrics indicate elevated risk: the domain is flagged by 9 out of 95 security vendors on VirusTotal, appears on 3 security blocklists, and is referenced in 2 AlienVault OTX threat intelligence pulses. Additionally, the domain is actively blocked by multiple browser-based security extensions. As of the latest assessment, yubit-qgwg.com remains operational, with no evidence of takedown or sinkholing. The use of Cloudflare and HTTP/3 further complicates mitigation efforts by obscuring origin servers and leveraging encrypted traffic. Given the domain's recent registration and persistent detection across multiple threat intelligence platforms, the risk of credential theft and financial loss remains elevated. Users are advised to avoid interaction with the domain, and network administrators should implement blocking at the DNS or IP level to prevent access.