yhtew[.]cn

Analysis of the domain yhtew.cn shows a confirmed brand‑impersonation campaign targeting Binance. The domain was registered on 25 November 2025 through Web Commerce Communications Limited and resolves to the IP address 161.248.14.214, which is hosted in Hong Kong under ASN 4907 (BGPNET PTE. LTD.). No TLS certificate is presented, indicating that the site operates without HTTPS protection. The page title returned from the HTTP response is "Mercado Libre," which does not match the advertised Binance theme and suggests a possible content‑swap or misdirection technique, though the exact page content has not been examined.

Gridinsoft assigns a trust score of 0 out of 100, reflecting a high likelihood of malicious intent. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy service, confirming that at least one defensive platform has taken protective action. AlienVault Open Threat Exchange has indexed the domain in fifteen separate threat‑intel pulses, indicating recurring observations across multiple feeds. VirusTotal scans report that 19 of 95 antivirus and URL‑reputation engines flag the domain as malicious, providing additional corroboration of its threat status.

Nameserver configuration uses a.share‑dns.com, a2.share‑dns.com, b.share‑dns.net, and b2.share‑dns.net, a pattern commonly observed in disposable or fast‑flux hosting setups. The current operational status is listed as offline, which may limit immediate interaction but does not eliminate the risk of re‑activation. Defenders should continue to block the domain at perimeter filters, monitor the associated IP range for any resurgence, and add the domain to internal blacklist feeds. Ongoing vigilance is advised, especially for assets that process Binance credentials, as the infrastructure could be repurposed for credential harvesting or other financial fraud vectors.