yupooclothes[.]com

Analysis of yupooclothes.com, observed as a high‑risk generic phishing infrastructure, shows that the domain was registered on 26 February 2024 through Dynadot LLC and uses the authoritative name servers ns1.dyna-ns.net and ns2.dyna-ns.net. DNS resolution points to the IPv4 address 8.210.183.25, which belongs to ASN 45102 (Alibaba (US) Technology Co., Ltd.) and is geolocated in Hong Kong. The site currently returns an HTTP 403 Forbidden response and does not present an SSL/TLS certificate, indicating that any credential‑harvesting traffic would have been delivered over plain HTTP before the host was taken offline. Threat‑intelligence feeds corroborate malicious use: the domain appears in fourteen AlienVault OTX pulses and has been flagged by seventeen of ninety‑five VirusTotal scanners.

Independent blocklists including PhishDestroy, Polkadot, Enkrypt and Codeesura have already listed the host, and four additional security blocklists reference the same indicator. The combination of recent registration, dedicated “dyna‑ns.net” name servers, and the lack of HTTPS protection aligns with typical phishing staging practices. Uncertainty remains regarding the specific payload or credential‑stealing page that was served, as the only observed HTTP status is a generic 403 error and no page content has been captured. Consequently, the exact phishing lure cannot be confirmed.

Defenders should add 8.210.183.25 and yupooclothes.com to network‑level deny lists, enforce DNS sink‑hole rules for the domain, and monitor for any resurgence of the domain or its associated IP range. Given the high risk rating, security appliances should block any outbound connections to the host, and incident response teams should verify that no internal credentials were exfiltrated during the brief window when the site was reachable. Continued watch‑listing of the domain on threat‑intel platforms is recommended to capture any future re‑use.