xnb-binance[.]com[.]cn

PhishDestroy identifies xnb-binance.com.cn as an active brand impersonation domain masquerading as Binance, a major cryptocurrency exchange. The domain is engineered to deceive users into divulging credentials or transferring funds to attacker-controlled wallets, fitting the crypto drainer profile. This tactic leverages Binance’s brand recognition to lend false legitimacy to the fraudulent site.

Technical indicators confirm the domain’s malicious nature. Registered through Web Commerce Communications Limited on March 26, 2026, it resolves to IP address 184.168.121.194 and is equipped with a Let’s Encrypt SSL certificate to appear trustworthy. Security vendor analysis via VirusTotal shows a detection ratio of 5/95, while Google Safe Browsing flags the domain as SOCIAL_ENGINEERING. It is currently blocked by Hagezi and appears on one additional security blocklist.

The domain remains active and poses an elevated risk to unwary users. Security teams should ensure immediate blocking via DNS, firewall, or proxy rules using the provided indicators. Users should avoid interacting with this domain entirely. Despite current mitigation efforts, the threat persists due to the domain’s recent creation and active hosting. Continuous monitoring and proactive threat hunting are recommended to detect further impersonation attempts or related infrastructure.