ejm[.]ypv[.]mybluehost[.]me

Analysis indicates that the domain ejm.ypv.mybluehost.me is actively flagged as a high-risk phishing site. Registered on March 6, 2026, through Domain.com, the domain currently resolves to IP address 69.6.192.222, hosted on Oracle Corporation’s AS31898 infrastructure located in Spain. The site returns an HTTP 302 redirect status, a common tactic used in phishing campaigns to obscure final landing pages or evade detection. Its SSL certificate is issued by Let’s Encrypt (R12), which, while not inherently malicious, is frequently exploited by threat actors due to its low-cost and automated issuance process. The page title, 'Welcome — Próximamente,' suggests a placeholder or 'coming soon' message, a pattern often observed in domains staged for phishing use prior to full deployment. This title does not explicitly reveal a targeted brand or service, and no confirmed phishing kit or victim organization has been identified in available intelligence. However, the domain appears on at least one security blocklist and is actively blocked by a threat intelligence provider. Eight out of 94 security vendors on VirusTotal have flagged the domain, indicating a consensus among multiple detection engines regarding its malicious nature. Infrastructure analysis reveals the use of nameservers ns1.mybluehost.me and ns2.mybluehost.me, consistent with hosting services that allow rapid domain provisioning and are sometimes abused for phishing operations. The domain’s creation date is recent, and its continued activity as of July 12, 2026, suggests it remains operational for malicious purposes. Defenders are advised to treat this domain as hostile. Network-level blocking of 69.6.192.222 and the domain itself is recommended. Organizations should monitor for connections to this infrastructure, particularly outbound HTTP 302 redirects, which may indicate compromised internal assets or user interaction with the phishing site.