cn[.]plhhovyj[.]com

This domain, cn.plhhovyj.com, is identified as a brand_impersonation threat specifically targeting Binance, a major cryptocurrency exchange platform. The site masquerades as a legitimate service, using a page title associated with ManBetX, a sports betting brand, which may serve as a social engineering lure to deceive users. No direct evidence of a drainer kit was observed, but the mismatch between the advertised content and the impersonated brand raises concerns about fraudulent intent. Infrastructure analysis reveals multiple technical indicators of compromise. The domain was registered on June 18, 2021, through NameCheap, Inc., and resolves to the IP address 172.65.201.65, hosted on Cloudflare’s network (AS13335). Security vendors on VirusTotal flagged the domain with a detection score of 16/95, indicating moderate consensus on its malicious nature. It appears on two security blocklists and is currently blocked by PhishDestroy and PhishingDB. The SSL certificate, issued by Sectigo Limited, does not mitigate the risk due to the domain’s fraudulent use. As of the latest assessment, cn.plhhovyj.com has been taken offline, reducing immediate exposure to potential victims. However, the domain’s historical activity and infrastructure remain a residual risk. Users who interacted with the site prior to its takedown should monitor for unauthorized transactions or account compromises. Organizations are advised to maintain blocklist updates and conduct retrospective log analysis to identify any prior engagement with this domain. The elevated risk classification underscores the need for continued vigilance against similar impersonation threats.