yrtbl[.]com

This domain, yrtbl.com, is an active phishing site impersonating Binance and specifically targeting USDT-related transactions, as indicated by its page title 'USDT'. Registered on February 27, 2026, through Gname.com Pte. Ltd., the domain currently resolves to 188.114.96.3, hosted on Cloudflare's infrastructure (AS13335) with nameservers anita.ns.cloudflare.com and jeremy.ns.cloudflare.com. The site employs a known seed phrase phishing kit, designed to harvest cryptocurrency wallet credentials. Analysis reveals the use of Vue.js and Cloudflare technologies, including HTTP/3, which may complicate detection and takedown efforts. The domain is flagged by five security vendors on VirusTotal and appears on four blocklists, including PhishDestroy, MetaMask, SEAL, and ScamSniffer. Defenders should note the HTTP 301 redirect behavior, which may indicate an attempt to evade automated crawlers or redirect victims to a secondary malicious endpoint. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the threat, as phishing sites commonly use valid certificates. Given the domain's recent registration, active status, and confirmed presence on multiple blocklists, defenders are advised to block traffic to this domain at the network level and monitor for related phishing kit indicators, such as specific JavaScript patterns or POST requests to unusual endpoints. The exact content and functionality of the site remain unanalyzed, but the combination of infrastructure, blocklist presence, and known phishing kit strongly suggests a high-risk threat targeting cryptocurrency users.