yfc22[.]net

Analysis of yfc22.net as of July 23, 2026 shows the domain is currently offline and has been taken down by the PhishDestroy takedown service. The site previously presented a page with the title “导航”, which offers no further insight into the targeted brand or content. Registration data indicates the domain was created on February 16, 2017 through the registrar 22net, Inc., and the authoritative name servers are sage.ns.cloudflare.com and surina.ns.cloudflare.com, both belonging to Cloudflare’s DNS service. The domain resolves to the IP address 45.138.71.205, which is announced by AS35251 NetLab Global and geolocated to the United States.

No SSL certificate was observed, meaning the site operated only over HTTP, a common characteristic of low‑trust phishing infrastructure. Reputation checks reveal a Gridinsoft trust score of 0 out of 100, and the domain appears on at least one public blocklist. VirusTotal reports that 19 of 93 scanned security engines flagged the domain, confirming malicious behavior consistent with generic phishing campaigns. AlienVault OTX lists the domain in two separate threat‑intel pulses, providing additional corroboration of its use in phishing operations.

The combination of a zero trust score, multiple vendor detections, blocklist inclusion, and OTX references indicates a high likelihood that the domain was employed for credential‑stealing or credential‑harvesting activities. Defenders should continue to block DNS resolution to 45.138.71.205 and enforce outbound filtering for HTTP traffic to this host. Existing network logs should be reviewed for any prior connections to the domain or its IP address, and any credential use originating from those sessions should be investigated for compromise. Because the site is offline, further content analysis is not possible, and the current status should be monitored for potential re‑hosting on other infrastructure.