yb-usdt[.]vip

The domain www.yb-usdt.vip was registered through Gname.com Pte. Ltd. and first observed on 21 February 2026. Infrastructure analysis shows the host resolves to 172.67.167.22, an address owned by Cloudflare, Inc. (AS13335) and located in the United States. Both authoritative name servers, lennon.ns.cloudflare.com and meilani.ns.cloudflare.com, are Cloudflare‑managed, confirming that the attacker is leveraging the provider’s CDN and protection services. The site presents an SSL certificate issued by Google Trust Services under the WE1 intermediate, indicating a valid TLS handshake despite the malicious intent. A HTTP request returns status code 200, and the page title reported by crawlers is “XRP Mining”, which does not match the advertised brand.

The intelligence classifies the operation as a brand‑impersonation campaign targeting Binance, consistent with the “Brand Impersonation” scam type flag. The Gridinsoft trust score is 0 out of 100, reflecting an extremely low reputation. VirusTotal analysis shows that 1 of 93 scanning engines flagged the domain, and the URL appears on a single external blocklist, currently blocked by PhishDestroy. No additional public blocklists or safe‑browsing entries are recorded.

Given the combination of a brand‑targeted impersonation, a trusted TLS certificate, and the use of a reputable CDN, the domain is likely to evade naïve network filters while delivering malicious content or credential‑harvesting pages. Defenders should immediately add 172.67.167.22 and www.yb-usdt.vip to deny‑list rules, monitor DNS queries for the associated Cloudflare name servers, and enforce strict outbound filtering for any traffic to the domain. Continuous re‑scanning with multi‑engine services is recommended to capture any future changes in the detection profile. The current evidence suggests the site remains active as of 22 July 2026, and the high risk rating is justified.