cvttopk[.]click

Analysis indicates that the domain www.cvttopk.click was registered on July 05, 2026 through Spaceship, Inc. The authoritative name servers launch1.spaceship.net and launch2.spaceship.net resolve the domain to the IPv4 address 47.242.217.10, which is allocated to AS45102 Alibaba (US) Technology Co., Ltd. and geolocated to Hong Kong. The web server responds with HTTP status code 200 and delivers content generated with Vue.js on an Nginx platform; no TLS certificate is presented, meaning the site is served over plain HTTP only. The page title reported by the scanner is the Chinese word “首页”, which translates to “home page”, but no further visual analysis is available. VirusTotal has evaluated the domain with 91 security vendors, of which 12 returned a malicious classification, reinforcing the suspicion of malicious activity.

The domain is listed on a single external blocklist and has been actively blocked by the PhishDestroy service. The threat classification provided by the intelligence feed is “Brand Impersonation” targeting the cryptocurrency exchange Binance. No evidence of additional infrastructure, such as hosting of command‑and‑control servers or malware payloads, is present in the current dataset. Uncertainty remains regarding the exact content served to visitors, the presence of credential‑harvesting forms, and any potential redirect chains, because the analysis relies on passive scans rather than direct interaction.

Defenders should update URL filtering rules to block www.cvttopk.click, monitor DNS queries for the associated IP address, and consider adding the IP to network‑level blocklists. Organizations using Binance services should educate users about the lack of TLS on this domain and reinforce verification of legitimate Binance URLs. Continuous re‑evaluation is advised, as the domain is still active and could evolve its payload.