vbyyuk[.]christmas

Analysis of www.vbyyuk.christmas indicates an active high‑risk brand‑impersonation campaign targeting Binance. The domain was registered on July 5 2026 through Spaceship, Inc. and resolves to IP 47.242.217.10, which is assigned to AS45102 (Alibaba (US) Technology Co., Ltd.) and geolocated to Hong Kong. Nameservers launch1.spaceship.net and launch2.spaceship.net are consistent with the registrar. The web server reports HTTP 200 and presents a page titled “首页”, while no TLS certificate is deployed, leaving the connection unencrypted. Infrastructure fingerprints show Nginx serving the site and a client‑side Vue.js framework, a combination frequently observed in modern phishing kits.

VirusTotal scans have flagged the domain by 7 of 91 security vendors, and the domain appears on one public blocklist and is already listed by PhishDestroy. The site’s declared scam type is “Brand Impersonation” and the target brand is Binance, confirming the intent to deceive users of that cryptocurrency exchange. Evidence beyond the page title is not yet publicly available; the exact content, login forms, or credential‑harvesting mechanisms have not been captured. Defenders should immediately block the domain and its hosting IP at perimeter and DNS layers, add the nameservers to watchlists, and monitor for additional domains registered through the same registrar or using the same AS.

Continuous re‑scanning with multi‑engine services is recommended to capture any changes in detection scores. Given the lack of TLS, any traffic to the site can be intercepted, but the primary risk remains credential theft through a likely counterfeit Binance login page. Organizations with Binance accounts should warn users to verify URLs and enforce multi‑factor authentication. Threat intelligence feeds should be updated with the indicator set (domain, IP, ASN, registrar) to improve early detection of related campaigns.