yhop[.]pro

The domain yhop.pro was registered on February 21, 2026 through NiceNIC International Group Co., Limited. It is hosted on Cloudflare’s network (AS13335) and resolves to the IP address 188.114.97.3, which is geolocated to the United States. The authoritative name servers are lauryn.ns.cloudflare.com and mark.ns.cloudflare.com, indicating that the domain relies on Cloudflare’s DNS and DDoS mitigation services. No TLS certificate was observed for the site, and the HTTP service is currently offline, consistent with the “taken offline” status reported by threat intel feeds. Analysis of public scanning platforms shows that six of ninety‑three antivirus or URL‑reputation engines on VirusTotal flagged the domain, suggesting that a minority of scanners have identified malicious characteristics.

The domain appears on a single security blocklist and is specifically listed by the PhishDestroy feed, confirming that it has been recognized as a phishing‑related resource. The only visible page element captured during the brief crawl was the title “Un instant…”, which provides no additional context about the intended victim or lure. Because the site is no longer reachable, direct observation of its content, payloads, or credential‑harvesting mechanisms is not possible. Consequently, the exact phishing campaign vector, targeted brand, or credential‑stealing kit cannot be confirmed at this time. The limited detection footprint—six VT detections and one blocklist entry—suggests that the infrastructure may have been short‑lived or that it was only partially propagated before being taken down.

Defenders should continue to monitor the IP address 188.114.97.3 for any re‑use, as Cloudflare customers often share the same edge IPs. Updating local and network‑level blocklists to include yhop.pro and its associated name servers will prevent accidental access should the domain be re‑activated.