app[.]vuahox[.]com

app.vuahox.com was registered on July 23, 2026 through Fewmoretaps OU d/b/a Trustname.com. The authoritative name servers are emerson.ns.cloudflare.com and thea.ns.cloudflare.com, indicating the domain is using Cloudflare’s DNS service. DNS resolution points to the IPv4 address 104.21.17.59, which belongs to Cloudflare’s edge network. The domain is listed on a single security blocklist and has been flagged by PhishDestroy, confirming that at least one security provider has observed malicious activity associated with the host.

VirusTotal has recorded scans from 91 anti‑malware engines; none of the engines reported a detection. Although the lack of detections may suggest the payload is either novel or not currently recognized by the scanners, the presence on a phishing blocklist overrides this uncertainty. No public SSL/TLS certificate details, HTTP response codes, page title, or additional payload indicators have been disclosed, so the content served by the site remains unverified. The rapid creation date—only three days before the report date—combined with the use of a reputable CDN provider is a common pattern for short‑lived phishing infrastructure designed to evade reputation buildup.

Defenders should proactively block traffic to 104.21.17.59 and to the domain app.vuahox.com at the DNS and firewall layers. Continuous monitoring of Cloudflare‑hosted IP ranges for anomalous traffic patterns is advised, as the same edge IP may be reused for multiple malicious campaigns. Analysts should also request a live crawl of the site to capture page titles, form fields, and any redirects, which will enable more precise attribution and remediation. Until further forensic evidence is obtained, the domain should be treated as active malicious infrastructure.