auth-sso-binance-login-us-en[.]typedream[.]app

This domain was observed by threat intel feeds on July 23 2026. The fully qualified host auth-sso-binance-login-us-en.typedream.app resolves to the Cloudflare edge address 172.67.206.36, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. Registration information shows the domain was created on 22 January 2021 through Squarespace Domains II LLC, and the authoritative nameservers are annalise.ns.cloudflare.com and darwin.ns.cloudflare.com. The site presented a Cloudflare-generated page titled "Suspected phishing site | Cloudflare" and returned HTTP 403, indicating that the content was blocked by Cloudflare. An SSL certificate issued by Google Trust Services (CN WE1) was observed, confirming the use of Google’s certificate infrastructure.

Infrastructure analysis reveals a stack consisting of Node.js, React, Next.js, Google Cloud services, Google Cloud Trace, Google Cloud CDN, Webpack, and Cloudflare front‑end delivery. These components are consistent with a modern web application framework often leveraged by credential‑stealing kits. VirusTotal scans recorded fifteen positive detections out of ninety‑three antivirus engines, and the domain appears on a single external blocklist. PhishDestroy listed the host as blocked, and the overall risk rating was elevated.

The domain explicitly impersonates the cryptocurrency exchange Binance, as indicated by the brand target field. No additional public evidence describing the page layout or login flow is available, so the exact phishing vector remains unconfirmed. Defenders should continue to block the IP address 172.67.206.36 and enforce DNS‑based filtering for the domain, monitor for any re‑registration attempts, and update intrusion‑prevention signatures with the observed TLS fingerprint and header patterns. Because the site is currently offline, ongoing surveillance is recommended to detect potential redeployment under the same or similar hostnames.