yftul[.]christmas

Analysis of yftul.christmas as of July 28 2026 shows a newly created domain (registered 5 June 2026) hosted by Spaceship, Inc. The authoritative nameservers launch1.spaceship.net and launch2.spaceship.net resolve the domain to the single IPv4 address 47.242.217.10. VirusTotal has recorded eight detections out of ninety‑one scanned vendors, indicating that multiple security products have flagged the domain as malicious. The domain is currently listed as active and has been added to at least one public security blocklist; it is also blocked by the PhishDestroy mitigation service, which suggests that defensive communities have observed phishing‑related activity originating from this host.

No public SSL certificate information, HTTP response codes, Safe Browsing verdicts, or Open Threat Exchange (OTX) reports are available for the domain at this time, and the page title has not been disclosed. Consequently, the precise phishing landing page content and any credential‑harvesting mechanisms remain unknown. Defenders should continue to enforce network‑level blocks for the IP address 47.242.217.10 and add yftul.christmas to local deny lists.

Monitoring of DNS queries for the two launch*.spaceship.net nameservers is advised, as any sudden changes could indicate infrastructure shifts. Because the domain is already flagged by multiple vendors and appears on blocklists, intrusion‑detection signatures that reference the domain name or its IP should be deployed. Ongoing telemetry collection from endpoint agents and web proxies will help capture any future payloads or URLs that may be associated with this campaign.