app[.]gamerbooms[.]xyz

The domain app.gamerbooms.xyz was registered on 21 February 2026 and is currently listed as offline. Technical inspection shows that the hostname resolves to the IP address 172.67.200.10, which belongs to Cloudflare, Inc. (AS13335) and is geolocated to the United States. The TLS certificate presented for the site is identified as WE1, indicating a valid SSL handshake but offering no indication of legitimate ownership. The public page title returned by the HTTP response is “GamerBoom”, which does not directly reference the targeted brand but aligns with the domain’s secondary label. The campaign is classified as a crypto‑scam impersonating Binance.

Evidence of this attribution comes from the explicit “Brand target: binance” field in the intelligence feed. The site has been observed on two independent security blocklists, namely PhishDestroy and ScamSniffer, and both have issued removal actions. VirusTotal analysis records three positive detections out of ninety‑three submitted scanners, confirming that at least a subset of AV engines recognize the domain as malicious. Because the service is already taken offline, no live HTTP response or content can be retrieved for deeper behavioral analysis.

Consequently, details such as login form structure, credential capture mechanisms, or secondary redirect chains remain unknown. Defenders should continue to reference the static indicators – domain name, registration date, IP address, ASN, SSL certificate fingerprint, blocklist listings, and the three VirusTotal detections – when building detection rules or threat‑intel feeds. Monitoring for re‑registration of the same second‑level domain or reuse of the 172.67.200.10 Cloudflare edge node in future campaigns is advisable. Organizations that enforce Binance‑related domain allowlists should add app.gamerbooms.xyz to their deny lists to pre‑empt any resurgence of the impersonation attempt.