thwmigj[.]yudasise[.]com

This domain, thwmigj.yudasise.com, is identified as a credential theft operation designed to harvest user login credentials through deceptive landing pages. Analysis indicates no association with known brand impersonation or cryptocurrency drainer kits, suggesting a generic but targeted approach to credential acquisition. The infrastructure appears to prioritize rapid deployment and evasion, as evidenced by the lack of SSL certification and minimal brand-specific indicators. Technical indicators reveal the domain was registered on April 26, 2026, through Name SRS AB, a registrar historically linked to transient malicious domains. It resolves to the IP address 104.206.0.234, hosted under AS62904 (Eonix Corporation), a network frequently observed in phishing and malware distribution campaigns. Detection metrics show 19 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on a single security blocklist. Notably, the domain lacks Google Safe Browsing (GSB) coverage, likely due to its recent creation and limited exposure. As of the latest assessment, thwmigj.yudasise.com has been taken offline, though residual risk persists due to the domain's registration remaining active. The hosting provider's response to abuse reports remains unconfirmed, and the registrar has not yet suspended the domain. Users who may have interacted with the domain are advised to rotate credentials for any accounts accessed during the exposure window, particularly if multi-factor authentication was not enabled. Organizations should monitor network logs for connections to 104.206.0.234 and consider blocking the IP at the perimeter to mitigate potential follow-up campaigns leveraging the same infrastructure.