yurft[.]christmas

Analysis indicates that the domain yurft.christmas was registered on 19 May 2026 through Spaceship, Inc. and is currently active. The authoritative nameservers launch1.spaceship.net and launch2.spaceship.net resolve the domain to the IPv4 address 47.242.217.10. The infrastructure has been observed on a single security blocklist and is actively blocked by the PhishDestroy feed. VirusTotal scans show that seven of ninety‑one participating security vendors have flagged the domain as malicious, reinforcing the classification of generic phishing.

The high risk rating aligns with the observed detection activity and the fact that the domain is still resolvable. Available intelligence does not include SSL certificate details, HTTP response codes, page title, or any observed payload. Consequently, the precise phishing vector, targeted brand, or credential‑capture mechanism remains undocumented. Defenders should treat the domain as hostile and block network traffic to the associated IP address and DNS name.

Updating perimeter firewalls, DNS filtering solutions, and endpoint protection with the indicator of compromise (IOC) – domain name and IP – is recommended. Continuous monitoring of the IP reputation and any emerging detections on additional blocklists will help to capture potential expansion of the campaign. Organizations using PhishDestroy or similar threat‑intel feeds should ensure the feed is applied to email gateways and web proxies to prevent user exposure. Given the recent registration date, the domain may be part of a fast‑flux or short‑lived phishing operation; therefore, periodic re‑assessment of the domain’s status is advisable.