muabillgia[.]com

muabillgia.com was registered through NameCheap, Inc. on 25 November 2025. The domain resolves to the Cloudflare edge address 172.67.163.48, associated with AS13335 (Cloudflare, Inc.) and is served from the United States. Authoritative nameservers are ian.ns.cloudflare.com and zoe.ns.cloudflare.com. No TLS certificate is presented, indicating the site was accessed via plain HTTP at the time of analysis. The page title retrieved from the live site reads "Hệ Thống Website Fakebill Chuyển Khoản | Công Cụ Tạo Bill CK Miễn Phí, Giao …", which references a fake‑bill generation tool and confirms the intent to impersonate the Binance brand.

Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single external security blocklist. VirusTotal reported a single positive detection out of 95 scanned vendors, and the domain is listed as blocked by PhishDestroy. The overall risk assessment is elevated, and the current operational status is offline. Analysis indicates that the infrastructure leverages Cloudflare’s free DNS and CDN services, a common tactic to obscure the true hosting location and to benefit from Cloudflare’s reputation. The lack of an SSL certificate suggests that the operators may have relied on HTTP to reduce setup complexity, or that the site was taken down before a certificate could be provisioned.

The Vietnamese language page title and the presence of "Fakebill" terminology imply a targeted campaign aimed at Vietnamese speakers, potentially to lure victims into providing Binance credentials or to process fraudulent transfers. Defenders should add 172.67.163.48 to network blocklists, enforce DNS filtering for the domain and its known Cloudflare nameservers, and monitor for any future re‑registration attempts. Because the domain was flagged by only one VirusTotal vendor, additional sandboxing or heuristic analysis of any payloads that reference the domain is advisable.