ymbvall[.]com

Analysis indicates that ymbvall.com is an active phishing domain registered on March 10, 2026, through Hello Internet Corp. The domain currently resolves to the IP address 91.92.243.12 and uses a Let's Encrypt SSL certificate, which provides encryption but does not validate legitimacy. The page title observed is 'Loading,' suggesting the site may be in an intermediate or transitional state, potentially awaiting redirection or dynamic content injection typical of phishing infrastructure. As of July 15, 2026, the domain remains active and has been flagged in two threat intelligence pulses on AlienVault OTX, indicating prior detection by security researchers. Two out of 95 security vendors on VirusTotal have identified the domain as malicious, though the specific nature of the threat—such as the targeted brand or phishing kit in use—has not been confirmed. The exact content and intended victim profile are not yet analysed, but the combination of recent registration, minimal detection coverage, and a generic page state aligns with common phishing deployment patterns. Defenders should treat this domain as high-risk and consider blocking or monitoring access to it. Further investigation, including sandbox analysis or passive DNS review, is recommended to determine the full scope of the threat.