yuaohoosmainl[.]sbs

This domain, yuaohoosmainl.sbs, is flagged as a generic phishing portal designed to mimic a PDF viewer interface. Analysis indicates no direct association with known brand impersonation templates or drainer kits, though the page title 'PDF Viewer' suggests an attempt to deceive users into believing they are accessing a legitimate document service. The domain exhibits characteristics typical of credential harvesting campaigns, likely targeting users expecting to view or download PDF files. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 212.11.64.144, hosted on AS42624 (Global-Data System IT Corporation) in Switzerland. It was registered on February 21, 2026, an unusually future-dated creation that may indicate automated or bulk registration tactics. The SSL certificate is classified as R13, a low-assurance certificate type often associated with malicious or short-lived domains. VirusTotal reports 17 out of 95 security vendors detecting the domain as malicious, while it appears on one security blocklist. Google Safe Browsing (GSB) does not currently list the domain, though this may reflect a lag in detection rather than absence of risk. As of the latest assessment, yuaohoosmainl.sbs has been taken offline, likely in response to detection by security systems such as PhishDestroy. However, the elevated risk level persists due to the domain's recent registration, suspicious infrastructure, and the potential for reactivation under a new IP or certificate. Users who accessed the site should assume credential exposure and initiate password resets on any accounts accessed during the interaction window. Organizations are advised to monitor network logs for connections to 212.11.64.144 and implement domain-based blocking for yuaohoosmainl.sbs to prevent future access attempts.