yurbabridge[.]xyz

Analysis of the domain yurbabridge.xyz, registered on 21 February 2026 through NiceNIC International Group Co., Limited, indicates a crypto‑related impersonation campaign targeting Binance users. The domain resolves to 172.67.137.179, an address owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. DNS resolution is handled by the Cloudflare‑provided nameservers riha…ns.cloudflare.com and ryan.ns.cloudflare.com, confirming the use of Cloudflare’s edge network. The site presents a TLS certificate issued by Google Trust Services under the WE1 trust store, which validates the HTTPS connection but does not imply legitimacy of the hosted content. Automated tooling detected the presence of Cloudflare services and HTTP/3 support, consistent with the observed infrastructure.

The only publicly visible artifact is the page title “The Best Crypto & Binance Bridge | cBridge”, which explicitly references Binance and suggests a bridge service. The intelligence classifies the operation as a “Crypto Scam” and records that the domain impersonates Binance. VirusTotal scans show nine of ninety‑three security vendors flagging the domain, indicating a moderate level of detection across the ecosystem. The domain has been listed on a single external blocklist and is actively blocked by PhishDestroy. Current status is marked offline, and no additional content has been captured.

Consequently, the exact phishing workflow, credential‑capture mechanisms, or malicious payloads remain unknown. Defenders should continue to block the IP address 172.67.137.179, add yurbabridge.xyz to internal deny lists, and monitor for any re‑registration or similar domains using the same registrar or nameserver pattern. Continuous observation of Cloudflare edge IP ranges for sudden appearance of new domains with Binance‑related titles is advised.