yfyuwe[.]crmnaceb[.]com

Analysis of yfyuwe.crmnaceb.com shows a high‑risk, active phishing infrastructure. The domain resolves to 172.67.184.93, an IP owned by Cloudflare, Inc. and geolocated to Canada. DNS is served by autumn.ns.cloudflare.com and boyd.ns.cloudflare.com, and the site presents a valid Let’s Encrypt certificate (issued to YE2). HTTP requests return a 302 redirect, and the page title is "ok交易所_ok交易所app官方下载/app下载最新版本/官网网址", indicating a possible focus on a cryptocurrency exchange download page, although the exact content has not been examined. The domain is listed on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. Google Safe Browsing flags the site for social engineering, and VirusTotal reports five detections out of 91 scanning engines. Registration was performed through Gname.com Pte. Ltd. The limited public evidence points to a credential‑harvesting campaign targeting users seeking exchange applications. Defenders should add the domain and its IP to firewall and proxy deny lists, update web‑filter signatures, and monitor for similar Cloudflare‑hosted redirects. Continuous telemetry collection is advised to detect any payload changes or new targeting vectors.