fakebillxyz[.]com

The domain fakebillxyz.com was registered on November 18, 2025 through Porkbun LLC. It resolves to the IP address 188.114.97.3, which is advertised as part of Cloudflare, Inc. (AS13335) and is physically located in the United States. The domain is currently active and returns an HTTP 301 redirect. Its TLS certificate is issued by Google Trust Services under the WE1 root, indicating a valid public‑trusted certificate. Infrastructure analysis shows the domain is served behind Cloudflare’s network, using the authoritative nameservers audrey.ns.cloudflare.com and earl.ns.cloudflare.com. The web server advertises support for HTTP/3 and is built with Tailwind CSS, confirming a modern front‑end stack. No additional hosting providers are evident beyond the Cloudflare edge. Threat intelligence flags fakebillxyz.com as a high‑risk brand‑impersonation site targeting the Telegram brand. The page title “Fake Bill - Tạo Bill Giả Số 1 Tại Việt Nam | FAKEBILLXYZ.COM” suggests the site attempts to lure victims with a fake billing service. Two of ninety‑five VirusTotal scanners have flagged the domain, and Gridinsoft assigns a trust score of 0 out of 100. The domain appears on one security blocklist and has been explicitly blocked by PhishDestroy, confirming its malicious use. Defenders should add fakebillxyz.com to network deny lists and configure email filters to block any communications referencing the domain. Continuous monitoring of DNS resolutions and TLS certificate changes is advised, as the Cloudflare front‑end could be leveraged for rapid re‑hosting. Threat hunters should also watch for similar impersonation attempts that reuse the same page title or branding language.