yxzku[.]cn

This domain, yxzku.cn, is identified as a brand impersonation threat targeting Binance users through a deceptive interface labeled as Mercado Libre. The site is designed to harvest login credentials, financial details, or other sensitive information by mimicking legitimate platforms. Its fraudulent nature is underscored by the misleading page title, which does not align with the purported target brand, increasing the likelihood of successful social engineering attacks against unsuspecting users. Analysis indicates yxzku.cn exhibits multiple high-risk indicators. The domain is flagged by 17 out of 95 security vendors on VirusTotal, confirming its malicious classification. It was registered on December 26, 2025, through Web Commerce Communications Limited, a registrar frequently associated with abusive domains. Infrastructure analysis reveals the domain resolves to IP address 137.220.157.113, hosted under AS4907 (BGPNET PTE. LTD.) in Hong Kong. Notably, the domain lacks an SSL certificate, a critical security omission that exposes user interactions to interception. It appears on one security blocklist and was proactively taken offline, though its infrastructure remains a potential vector for future threats. Users who accessed yxzku.cn should assume their credentials or financial information may have been compromised. Immediate actions include resetting passwords for Binance and any other accounts where identical credentials were reused. Enable multi-factor authentication (MFA) on all financial and cryptocurrency platforms to mitigate unauthorized access. Monitor accounts for unauthorized transactions or suspicious activity, and report any anomalies to the respective platform’s security team. If personal or financial data was entered, consider placing a fraud alert with credit bureaus and reviewing device logs for signs of malware or unauthorized access. Given the domain’s elevated risk level, affected users should also scan their systems for potential infections using updated security tools.