trx-binance[.]com[.]cn

PhishDestroy identifies trx-binance.com.cn as a suspected brand-impersonation site targeting Binance users. The domain leverages the Binance brand to deceive visitors into disclosing login credentials or transferring cryptocurrency under false pretenses, posing a direct threat to financial assets and account integrity.

This domain was flagged with a Risk Level of UNDER_INVESTIGATION due to active impersonation behavior. VirusTotal currently reports 6 out of 95 detection engines flagging the domain. It was registered through 北京新网数码信息技术有限公司 on April 21, 2026, and resolves to IP address 154.26.226.36. The site employs a Let’s Encrypt SSL certificate, which does not indicate legitimacy. As of this report, no public blocklists have flagged the domain, and domain age is extremely low, increasing the risk of rapid deployment for malicious campaigns.

Users encountering this domain should immediately cease interaction and avoid entering any credentials or financial information. The threat type—brand impersonation—relies on visual deception and urgency to trick users. Report the domain to your organization’s security team and submit a takedown request via the registrar or abuse channels. Use only official Binance domains (binance.com or verified regional equivalents) and enable multi-factor authentication on cryptocurrency accounts. Block the IP 154.26.226.36 and domain at the network level if possible. Remain vigilant for similar domains using slight misspellings or brand variations.