YR2

URLs

Brands targeted

Unique IPs

Suspicious sites — confidence is not always 100%. Use for Threat Hunting or watchlists.

Last check (UTC)	First seen (UTC) ▾	URL	Flags	Details
2026-06-10 07:30	2026-06-07 01:02	http://finance-binance.org.hedgefunds-investment.com	OpenPhish	Details
2026-06-10 07:30	2026-06-05 01:00	https://zh-coinbase.com	OpenPhish urlscan	Details
2026-06-10 07:30	2026-06-04 01:01	http://b-instagram.com.cn	OpenPhish	Details

Suspicious sites — confidence is not always 100%. Use for Threat Hunting or watchlists.

URL	Flags	Details
http://finance-binance.org.he…	OpenPhish	Details
https://zh-coinbase.com	OpenPhish urlscan	Details
http://b-instagram.com.cn	OpenPhish	Details

Brands most often impersonated with YR2

Among the active sites currently using a YR2 certificate, these are the brands attackers are mimicking most: