ymsox[.]com

This domain is classified as an elevated-risk brand_impersonation threat specifically targeting Binance, a major cryptocurrency exchange platform. Analysis indicates the infrastructure was designed to deceive users into believing they were interacting with legitimate Binance services, though the page title 'Mercado Libre' suggests potential cross-brand confusion tactics or operational error during deployment. Infrastructure analysis reveals multiple technical indicators of malicious intent. The domain ymsox.com was registered on November 17, 2025, through Global Domain Group LLC, a registrar frequently associated with high-risk domains. It resolves to IP address 137.220.153.38, hosted in Hong Kong under AS4907 (BGPNET PTE. LTD.), an autonomous system previously linked to phishing campaigns. The domain lacks SSL certification, increasing vulnerability to man-in-the-middle attacks. Security vendors flagged this domain in 20 out of 95 VirusTotal scans, while it appears on two independent security blocklists. Additional detection sources include PhishDestroy and PhishingDB, confirming its classification as a phishing resource. To mitigate risks associated with this brand_impersonation threat, organizations should implement the following measures: Immediately block the domain ymsox.com and its resolving IP 137.220.153.38 at firewall and DNS filtering levels. Deploy indicators of compromise (IOCs) across security information and event management (SIEM) systems to detect any residual connections. Cryptocurrency platforms should monitor for unauthorized access attempts originating from this infrastructure and enforce multi-factor authentication (MFA) for all user accounts. End users should be educated on recognizing brand_impersonation tactics, particularly those involving cryptocurrency exchanges, and encouraged to verify domain authenticity through official channels before entering credentials or conducting transactions.