kingyabg[.]com

Analysis of kingyabg.com indicates that the domain is being used for a wallet/seed phishing operation targeting users of the Binance platform. The site was registered on 8 November 2025 through NameCheap, Inc. and is hosted on Cloudflare infrastructure, resolving to the IPv6 address 2606:4700:3032::6815:58fb located in the United States under ASN 13335. No TLS certificate is presented, and the HTTP service has been taken offline at the time of this assessment. The page title returned by the server is "USDC", which aligns with the cryptocurrency theme of the campaign.

Google Safe Browsing flags the domain for social engineering, and the Gridinsoft trust score is 0 out of 100, indicating a lack of legitimacy. Independent threat‑intelligence sources have added the domain to at least one security blocklist, and PhishDestroy confirms it as a blocked resource. VirusTotal reports that 12 of 95 scanning engines have identified malicious activity associated with the domain, reinforcing the suspicion of phishing intent. The domain impersonates Binance, suggesting that attackers may be attempting to harvest wallet credentials or seed phrases from unsuspecting users.

While the offline status prevents immediate interaction, the infrastructure details remain active and could be repurposed for future campaigns. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists, and monitor for any resurgence of the host. Additional investigation of the resolved IP may reveal other malicious domains sharing the same Cloudflare edge, and threat‑intel sharing of the IPv6 address can aid in correlating related activity. Until the site is permanently taken down, organizations are advised to educate users about unsolicited requests for wallet information and to enforce multi‑factor authentication on Binance accounts.