was[.]becrown[.]life

The domain was.becrown.life has been identified as a high‑risk brand‑impersonation site targeting users of the Binance platform. The site is actively serving content and returns HTTP status code 526, indicating an invalid SSL certificate. Its creation date of June 03 2026 and immediate appearance on blocklists suggest a deliberate phishing campaign.

Infrastructure analysis shows the domain is hosted behind Cloudflare. It resolves to IP address 188.114.97.3, which is registered to Cloudflare, Inc. in Canada. The authoritative nameservers are dean.ns.cloudflare.com and emely.ns.cloudflare.com. Although the TLS handshake presents a certificate issued by Google Trust Services (WE1), the mismatch between the certificate and the domain triggers the 526 error, a common tactic used to bypass browser warnings while still delivering malicious payloads.

Threat intelligence feeds corroborate the malicious nature of the domain. VirusTotal records five out of ninety‑five security vendors flagging the site, and it appears on at least one public blocklist. The Gridinsoft trust score is 0 out of 100, reinforcing the assessment of a low‑reputation resource. PhishDestroy has already added the domain to its blocklist, indicating that upstream protection services are aware of the threat.

Defenders should immediately block was.becrown.life at the DNS and network layers, and add the associated IP 188.114.97.3 to deny lists. Continuous monitoring of Cloudflare‑hosted name servers for similar newly registered domains can help detect follow‑on campaigns. Organizations should also educate Binance users about the risk of invalid SSL warnings and encourage verification of legitimate Binance URLs before entering credentials.