ys904[.]top

The domain ys904.top is currently identified as a malicious login phishing site and maintains an active status. While the specific brand impersonated by this domain is not explicitly noted, the threat type indicates a focus on deceptive logins to illicitly capture user credentials. The domain continues to present a high risk due to its current operational state and phishing activities.

Technical analysis reveals that the domain ys904.top is flagged by 4 out of 95 security vendors on VirusTotal, highlighting its potential malicious intent. The domain resolves to the IP address 188.114.96.3 and utilizes an SSL certificate issued by Google Trust Services, a detail that may lend it an appearance of legitimacy to unsuspecting users. Registered through Gname.com Pte. Ltd., the domain was created on May 13, 2025, suggesting a newly established phishing infrastructure. Additionally, the domain features in one threat intelligence pulse on AlienVault OTX, indicating some recognition in threat databases.

Given the active status of the ys904.top domain and its involvement in phishing activities, it poses a significant risk to internet users. It is recommended that users and organizations apply stringent email filtering and web browsing restrictions to mitigate exposure to this domain. Security teams should update blocklists to include this domain and monitor network traffic for any signs of communication with the IP address 188.114.96.3. Continuous threat intelligence monitoring is advised to stay informed of any changes in the domain's activity or associated IP addresses.