cvxbuuj7[.]pics

On July 22, 2026 the domain www.cvxbuuj7.pics was observed hosting a high‑risk brand‑impersonation campaign targeting Binance. The site returns HTTP 200 and presents the page title “首页”, which is a generic Chinese term for “home page”. No TLS certificate is offered, meaning connections are unencrypted. The domain was registered only a week earlier on July 15, 2026 through Spaceship, Inc., and uses the launch1.spaceship.net and launch2.spaceship.net name servers.

DNS resolution points to the IPv4 address 47.242.217.10, an address geolocated to Hong Kong. The hosting IP appears on a single security blocklist and the domain is listed by the PhishDestroy blocklist. VirusTotal analysis shows that eight of ninety‑one scanning engines flagged the domain, indicating malicious characteristics consistent with brand‑impersonation activity. The page’s content has not been publicly disclosed beyond the title, so the exact visual mimicry of Binance cannot be confirmed, but the classification as a Binance impersonation is supported by the intelligence feed.

The lack of SSL, recent registration, and rapid deployment are typical of short‑lived phishing infrastructure. Defenders should add 47.242.217.10 and www.cvxbuuj7.pics to network and DNS blocklists, monitor for any new sub‑domains created under the same registrar, and enforce TLS inspection to detect any future attempts to serve malicious content from the same host. Continuous re‑scanning with multi‑vendor engines is advised to capture any changes in detection status. Because the domain remains active, immediate mitigation is recommended to protect users of Binance services.