yubit-ujmz[.]com

This domain, yubit-ujmz.com, is an active credential harvesting site targeting cryptocurrency users. The site mimics legitimate wallet or exchange interfaces to trick visitors into entering private keys, recovery phrases, or login credentials. Once submitted, these sensitive details are transmitted to threat actors, enabling immediate theft of digital assets from connected wallets or accounts. The site is designed to exploit users during transactions, airdrops, or token swaps, often leveraging urgency or fake security alerts to prompt immediate action. Infrastructure analysis indicates this is not a generic phishing page but a specialized operation focused on blockchain-based financial fraud. Analysis indicates high confidence in this assessment based on multiple technical indicators. The domain was registered on June 8, 2026, through Gname.com Pte. Ltd., an offshore registrar frequently associated with malicious infrastructure. At the time of investigation, 12 out of 95 security vendors on VirusTotal flagged this domain as malicious, with detections including terms such as 'phishing,' 'crypto-scam,' and 'credential theft.' The domain appears in two AlienVault OTX threat intelligence pulses and is blocked by three security blocklists, including MetaMask and PhishDestroy. The site resolves to IP address 188.114.97.3 and employs modern web technologies such as Vue.js and Cloudflare, which are often used to evade detection and improve performance. The SSL certificate is issued by Google Trust Services, adding a veneer of legitimacy to the malicious endpoint. If you visited yubit-ujmz.com or entered any sensitive information on the site, immediate action is required to mitigate potential loss. First, disconnect the affected device from the internet to prevent ongoing data exfiltration. Revoke any active sessions or authorizations granted to the site via wallet or exchange settings. If private keys or recovery phrases were exposed, transfer all assets from the compromised wallet to a new, secure wallet with a fresh seed phrase. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. Report the incident to relevant security teams, including blockchain security platforms and wallet providers, to help prevent further victimization. Do not reuse passwords or recovery phrases from the compromised account. Consider scanning the device for malware, as some phishing sites deploy additional payloads to maintain persistence.