xelaborn[.]sbs

On July 25, 2026, the domain xelaborn.sbs was observed as an offline site that previously hosted a credential‑capture page targeting Binance users. The page title returned by the server was “Giriş Yap”, a Turkish phrase meaning “Login”. The domain was registered on 17 December 2025 through Dynadot LLC and is served by Cloudflare nameservers christian.ns.cloudflare.com and wally.ns.cloudflare.com. DNS resolution points to the IPv4 address 46.151.182.165, which belongs to the Autonomous System AS205759 operated by Ghosty Networks LLC and is geolocated to Luxembourg.

No TLS certificate was presented, indicating that the site was delivered over plain HTTP. Malware‑scanning services on VirusTotal flagged the domain in 17 of 93 security vendors, and the same indicator appears in a single AlienVault OTX pulse. The domain is listed on one public blocklist and has been blocked by the PhishDestroy service. Independent reputation scoring from Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious classification.

The campaign is categorized as a crypto‑scam that impersonates the Binance brand, consistent with the “Crypto Scam” label in the intelligence feed. Because the site is currently offline, active exploitation cannot be confirmed, but the infrastructure footprint—particularly the hosting IP and registrar—remains a potential vector for future impersonation attempts. Defensive operators should add 46.151.182.165 to network‑level deny lists, monitor new domain registrations through Dynadot that resolve to the same IP range, and enforce URL filtering for the domain and its associated hostnames. Continuous re‑evaluation of the IP reputation and rapid ingestion of any re‑appearance of the domain into security telemetry are recommended to mitigate recurrence.