wooxqrwy[.]top

Analysis indicates that the domain www.wooxqrwy.top was registered on September 20, 2025, through Shanghai Meicheng Technology Information Development Co., Ltd., a registrar frequently associated with fraudulent domains. The domain resolves to the IP address 4.178.241.13, hosted under AS8075 (Microsoft Corporation) in France, though no SSL certificate was detected, increasing the risk of unencrypted data interception. At the time of assessment, the domain was offline, though its infrastructure remains a potential vector for future malicious activity. The page title 'Woox1' does not directly reference the targeted brand but aligns with the identified scam type: brand impersonation of Binance.

Detection data from security vendors is limited but notable; two of 95 vendors on VirusTotal flagged the domain as malicious, while PhishDestroy has explicitly blocked it. The domain appears on one security blocklist, and AlienVault OTX includes it in a threat intelligence pulse, suggesting prior malicious activity. Gridinsoft assigns a trust score of 0/100, reinforcing its classification as high-risk. Nameserver records (ns-1003.awsdns-61.net, ns-1136.awsdns-14.org, ns-1565.awsdns-03.co.uk, ns-489.awsdns-51.com) indicate the use of Amazon Route 53, a common infrastructure choice for both legitimate and malicious domains.

Defenders should treat this domain as a confirmed phishing threat targeting Binance users, despite its current offline status. Monitoring for reactivation or similar domains under the same registrar or hosting provider is recommended. Blocking the domain at the DNS or proxy level, along with reviewing logs for prior connections to 4.178.241.13, can mitigate residual risk. No evidence of a phishing kit or additional content analysis is available at this time.