vclbolgfxi[.]wwcoinbase[.]com

vclbolgfxi.wwcoinbase.com is flagged as a brand‑impersonation site targeting Binance users. The domain was registered through GoDaddy.com, LLC on 15 Mar 2025 and resolves to the IP address 99.84.152.89, which belongs to Amazon’s AS16509 infrastructure located in Germany. The hosting environment utilizes Amazon Web Services and is fronted by Amazon CloudFront, while the DNS is served by Cloudflare nameservers derek.ns.cloudflare.com and imani.ns.cloudflare.com. An SSL certificate issued by Google Trust Services under the WE1 label is present, indicating a valid HTTPS endpoint despite the malicious intent.

Web‑page metadata reveals the title “Create a free account | Binance”, directly copying Binance’s branding, confirming the impersonation claim. Traffic‑analysis scripts such as Google Analytics and Facebook Pixel are detected, suggesting the operators are collecting visitor data. Security‑vendor scans on VirusTotal show that 13 of 95 engines flag the domain as malicious, and it appears on at least one public blocklist. The site was also identified and taken down by PhishDestroy, and it is currently offline.

Although the site is not serving content at the moment, the infrastructure components—particularly the AWS hosting, CloudFront delivery, and Cloudflare DNS—remain reusable for future campaigns. Defenders should therefore add the domain and its associated IP address to network deny lists, monitor for re‑registration of similar subdomains under the wwcoinbase.com hierarchy, and enforce URL filtering for the exact page title pattern. Continuous observation of the ASN 16509 traffic and the Cloudflare name servers is advisable to detect any rapid redeployment. Organizations that use Binance services should educate users about the “Create a free account” lure and encourage verification of URLs before credential entry.