yoroidesktop[.]net

This domain, yoroidesktop.net, is flagged as a generic phishing site targeting users of desktop client software. Analysis indicates no direct association with a specific brand, but the infrastructure mimics legitimate desktop application login portals to harvest credentials. The site employs social engineering tactics, likely prompting users to enter sensitive authentication details under false pretenses. No known drainer kit signatures were identified in initial scans, though further forensic analysis may reveal additional payload delivery mechanisms. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited. It resolves to the IP address 216.150.1.1 and is currently offline. The domain has a VirusTotal detection score of 12/95 security vendors, indicating moderate confidence in its malicious nature. It appears on one security blocklist and has a Gridinsoft trust score of 0/100. Technologies detected include Vercel for hosting, LiveChat for potential real-time interaction with victims, and HSTS enforcement, which may be used to lend an air of legitimacy to the phishing page. The domain is currently offline, reducing immediate risk to end users. However, the infrastructure remains registered and could be reactivated or repurposed for future campaigns. Organizations should monitor for DNS resolution changes or renewed hosting activity. Users who may have interacted with the domain are advised to reset credentials for any accounts accessed during the exposure window. Network-level blocking of the IP 216.150.1.1 and domain yoroidesktop.net is recommended as a precautionary measure. No evidence of data exfiltration was confirmed in this analysis, but affected parties should conduct internal audits for unauthorized access.