uywybs[.]com

This domain, uywybs.com, is identified as a credential harvesting phishing site designed to mimic legitimate web development frameworks. Analysis indicates the site employs a Vite + Vue + TS page title, a common frontend stack, to appear credible while harvesting user credentials. The infrastructure leverages Cloudflare for hosting and CDN services, which may obscure the true origin of malicious activity and complicate takedown efforts. The domain was registered through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently associated with high-risk domains, and currently resolves to the IP address 104.21.9.165. Evidence supporting the elevated risk classification includes detection by 1 out of 95 security vendors on VirusTotal, a Gridinsoft trust score of 0/100, and presence on one security blocklist. The domain was created on April 28, 2026, an unusually future-dated registration that may indicate an attempt to evade reputation-based filters. Additional infrastructure analysis reveals the use of Google Cloud, Cloudflare Browser Insights, and HTTP/3, technologies that enhance performance but are also exploited to bypass traditional security controls. The domain is currently offline, but prior activity suggests it was actively targeting users before being taken down. Users who visited uywybs.com should immediately revoke any credentials entered on the site, particularly if they resemble login portals for financial, corporate, or personal accounts. Monitor accounts associated with the email addresses or usernames used on the site for unauthorized access or transactions. If the site was accessed via a corporate network, report the incident to internal security teams to assess potential lateral movement or data exfiltration risks. Consider implementing multi-factor authentication on all critical accounts to mitigate the impact of credential theft. Given the domain's use of Cloudflare and future-dated registration, remain vigilant for similar threats leveraging advanced evasion techniques.