resolv-migration[.]xyz

This domain, resolv-migration.xyz, is identified as a brand impersonation threat specifically targeting Binance, a major cryptocurrency exchange platform. Analysis indicates the site masquerades as the 'Resolv App,' a likely attempt to deceive users into believing they are interacting with legitimate Binance-affiliated services. The infrastructure aligns with tactics commonly used in crypto-related fraud, where victims are lured into disclosing sensitive credentials or transferring assets under false pretenses. Infrastructure analysis reveals the following technical indicators: the domain was registered on September 03, 2025, through OwnRegistrar, Inc., and resolves to the IP address 192.3.190.187. Security vendor assessments on VirusTotal show 6 out of 95 detections flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on four independent security blocklists, and its page title, 'Resolv App,' further corroborates the impersonation of Binance-related services. No direct evidence of a crypto drainer kit is observed, but the site’s design and branding suggest a focus on credential theft or fraudulent asset transfers. As of the latest assessment, resolv-migration.xyz has been taken offline, reducing immediate exposure to potential victims. However, the domain’s registration remains active, and the infrastructure could be repurposed for future campaigns. Users who interacted with the site are advised to revoke any connected wallet permissions, monitor accounts for unauthorized transactions, and reset credentials associated with Binance or other crypto services. Organizations should update blocklists to include this domain and its associated IP to mitigate residual risk.