Analysis of the domain yonewex.com indicates it is actively employed in a generic phishing campaign targeting credential harvest. The domain was registered on May 16, 2026 through Fewmoretaps OU d/b/a Trustname.com and is currently resolved to the IP address 188.114.96.3. DNS resolution is handled by Cloudflare, using the authoritative nameservers javier.ns.cloudflare.com and mira.ns.cloudflare.com.
Threat intelligence platforms have observed the domain on a single security blocklist and it is explicitly blocked by the PhishDestroy service. VirusTotal scans show that seven out of ninety-one security vendors have flagged the domain as malicious, reinforcing the suspicion of malicious intent. The domain remains active as of the report date, July 30, 2026.
No publicly available information on the site’s SSL certificate, HTTP response codes, page title, or content has been released, leaving the precise phishing lure and targeted brand unconfirmed. Defenders are advised to add yonewex.com to DNS and web proxy blocklists, monitor outbound connections to 188.114.96.3, and ensure email security gateways are configured to detect credential‑harvesting attempts associated with this domain. Continuous re‑evaluation is recommended, as additional detections or blocklist entries may emerge as the campaign evolves.