bnb-mixer[.]ru

This domain, bnb-mixer.ru, is flagged as a brand impersonation threat targeting Binance, specifically masquerading as a cryptocurrency mixer service for Binance Coin (BNB). The site advertises anonymity, no KYC requirements, and instant transactions, which are common lures for fraudulent mixer platforms designed to deceive users into transferring funds under false pretenses. Analysis indicates the domain is part of a broader campaign to exploit trust in Binance’s brand while facilitating unauthorized or illicit transactions, likely leading to financial theft or money laundering. Technical indicators confirm the malicious nature of bnb-mixer.ru. The domain resolves to IP address 172.67.199.73 and is flagged by 8 out of 95 security vendors on VirusTotal, including detections for phishing and fraudulent activity. It appears on at least one security blocklist and has a trust score of 0/100, indicating high confidence in its malicious classification. Infrastructure analysis reveals the use of Cloudflare and HTTP/3, suggesting efforts to obfuscate hosting details and evade detection. The page title, "BNB Миксер – Анонимно, Без KYC, Мгновенно," directly targets Russian-speaking users, further narrowing the scope of the threat. As of the latest assessment, bnb-mixer.ru has been taken offline, likely due to enforcement actions or hosting provider intervention. However, the remaining risk persists due to the potential for the threat actors to re-establish the domain or migrate to a new infrastructure. Users who interacted with the site should assume compromise of any credentials or transaction details shared. Organizations and individuals are advised to block the domain and its associated IP address, monitor for similar impersonation attempts, and verify all cryptocurrency-related services through official Binance channels before engaging in transactions.