binance-usd[.]com

PhishDestroy identifies binance-usd.com as a malicious domain engaged in active brand impersonation targeting Binance, specifically mimicking its branding to deceive users in cryptocurrency-related contexts. This domain features a drainer kit designed to trick victims into authorizing fraudulent transactions under the guise of legitimate Binance services. The imitation is sophisticated enough to exploit trust in well-known exchanges, posing a significant risk to unsuspecting users seeking to manage or trade digital assets.

This domain was flagged with a high detection rate—9 out of 95 security vendors on VirusTotal flagged it as malicious—indicating widespread recognition of its harmful nature. Registered through Dominet (HK) Limited, binance-usd.com resolved to IP 172.67.159.140 and was created on April 21, 2026. It holds a Let's Encrypt SSL certificate, which may be leveraged to appear legitimate, and has been blocked by InversionDNS. Additionally, this domain appears on 1 security blocklist and has no presence on Google Safe Browsing (GSB) lists, suggesting a relatively recent or targeted campaign.

Currently, binance-usd.com remains active, representing an elevated risk to users engaging with Binance-related services. Immediate response actions include blocking the domain at the DNS and network levels, leveraging threat intelligence feeds, and notifying affected users or organizations. While active measures mitigate exposure, the domain’s recent registration and high VT score (9/95) underscore the need for continued vigilance. Users are strongly advised to verify URLs before interaction and rely on official Binance domains or verified channels for all transactions.