binance-login[.]cx

Analysis of the domain binance-login.cx, registered on February 21, 2026, indicates it is a fraudulent crypto scam impersonating Binance. The domain resolved to the IP address 193.24.123.182, hosted on AS200593 (PROSPERO OOO) in Russia. Infrastructure analysis reveals the use of Cloudflare nameservers (amy.ns.cloudflare.com and kevin.ns.cloudflare.com) and technologies including Cloudflare Browser Insights and HTTP/3. The SSL certificate was issued by Google Trust Services (WE1), a common practice among both legitimate and malicious sites, providing no definitive indication of trustworthiness.

The page title, 'AAVE Price Prediction: Expert Analysis and Future Forecasts,' does not align with Binance branding, suggesting either a generic scam template or an attempt to lure cryptocurrency investors under false pretenses. As of July 24, 2026, the domain is offline, though it was previously flagged by 14 out of 93 security vendors on VirusTotal and appears on one security blocklist (PhishDestroy). The registrar, CentralNic Ltd, is a legitimate provider and does not inherently indicate malicious intent, though it has been used by threat actors in the past. No evidence confirms whether this domain operated as a credential harvester, fake exchange, or another form of crypto fraud, as the exact content was not analyzed.

Defenders should treat this domain as malicious based on its impersonation of Binance, detection by security vendors, and inclusion on blocklists. Network-level blocking of the IP 193.24.123.182 and the domain itself is recommended. Organizations should also monitor for related infrastructure, such as other domains using the same nameservers or hosting provider, as threat actors frequently reuse components across campaigns. Given the domain's current offline status, further forensic analysis may be limited, but historical logs should be reviewed for any prior connections.