binoztradfx[.]xyz

Analysis of binoztradfx.xyz shows the domain was created on October 11, 2025 and remains active as of the July 27, 2026 report date. Registration was performed through TuringSign Inc. d/b/a Cosmotown, and the authoritative name servers are dns1.lytehosting.com, dns2.lytehosting.com, dns3.lytehosting.com, and dns4.lytehosting.com. The sole A record resolves to the IPv4 address 163.61.188.5. VirusTotal data indicates that seven of ninety‑one scanned security vendors have flagged the domain, suggesting malicious intent despite a relatively low detection count.

The domain appears on a single external blocklist and is explicitly blocked by the PhishDestroy service, confirming that at least one security community source has taken mitigation action. No additional public signals such as Safe Browsing warnings, Open Threat Exchange entries, SSL/TLS certificate details, or HTTP status codes are presently available, leaving the surface‑level behavior largely unobserved. The limited visibility may reflect an early‑stage campaign or the use of evasion techniques to avoid broader detection.

Defenders are advised to add binoztradfx.xyz and its resolved IP 163.61.188.5 to deny‑list or firewall rules, monitor DNS queries to the LyteHosting name servers for anomalous activity, and continue to ingest threat‑intel feeds for any future escalation. Ongoing scrutiny of the registrar and hosting provider is recommended, as they have been associated with other malicious infrastructure in the past. Traffic destined for the domain should be inspected for credential‑harvesting payloads, and any compromised endpoints should be isolated and remediated promptly.