yellowcex[.]app

This domain, yellowcex.app, is identified as a credential harvesting phishing site designed to mimic legitimate login portals. Analysis indicates the infrastructure was specifically established to deceive users into submitting sensitive authentication credentials, which are then exfiltrated to attacker-controlled servers. The page title 'Buy' suggests an attempt to impersonate e-commerce or financial transaction platforms, a common tactic in credential theft campaigns. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on March 3, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with phishing operations. VirusTotal detection metrics show 19 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing explicitly classifies it as phishing. The domain resolves to IP address 188.114.97.3, hosted on AS13335 (Cloudflare, Inc.), and appears on one security blocklist. The SSL certificate, issued by Google Trust Services (WE1), provides encrypted connections to further deceive users. Users who visited yellowcex.app should immediately revoke any credentials entered on the site. Monitor accounts associated with the submitted information for unauthorized access or transactions. If financial data was exposed, contact relevant institutions to implement fraud protection measures. Security teams should update blocklists to include this domain and its resolving IP address. The domain's current offline status does not eliminate risk, as infrastructure may be reactivated under different identifiers.