y[.]org

This domain, y.org, is identified as a generic phishing site targeting users of YMCA's Digital Services. Analysis indicates the site was designed to impersonate the legitimate YMCA brand, likely to harvest credentials or distribute malicious payloads. The domain is currently offline, but prior activity suggests it was actively used for fraudulent purposes. Infrastructure analysis reveals y.org was registered through CSC Corporate Domains, Inc., with a creation date of April 21, 2026, an anomalous timestamp suggesting potential domain spoofing. The domain resolves to the IP address 104.18.8.112 and holds a Gridinsoft trust score of 0/100. It appears on one security blocklist and is flagged by 2 of 95 vendors on VirusTotal. Additionally, the domain is referenced in three threat intelligence pulses on AlienVault OTX, further corroborating its malicious nature. The SSL certificate is issued by Google Trust Services, which, while not inherently malicious, is often leveraged by threat actors to lend false legitimacy to phishing sites. The domain is currently offline, reducing immediate risk to end users. However, organizations and individuals should remain vigilant, as domains of this nature often reappear under different infrastructure. It is recommended to block y.org at the DNS or firewall level, monitor for related indicators of compromise (IOCs), and educate users on recognizing phishing attempts targeting YMCA or similar service providers. Security teams should also review logs for any prior connections to 104.18.8.112 or the domain itself to assess potential exposure.