# PhishDestroy domain threat record: hello-binance.com.cn

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/hello-binance.com.cn/
Machine-readable companion: https://phishdestroy.io/domain/hello-binance.com.cn/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-20 22:40:04 UTC
- Last availability or vendor check: 2026-10-22 10:40:37 UTC
- Stored record updated: 2026-10-22 15:46:59 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Binance

## Stored infrastructure

- Observed IP address: 45.122.133.246
- Registrar in stored WHOIS data: 温州市中网计算机技术服务有限公司

## Evidence links

- URLScan report: https://urlscan.io/result/01a15b77-a547-73be-bddf-ce0af1f38dab/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/hello-binance.com.cn
- Certificate Transparency search: https://crt.sh/?q=%25.hello-binance.com.cn
- Web Archive lookup: https://web.archive.org/web/*/https://hello-binance.com.cn/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s automated assessment classified the site as an impersonation phishing page because it uses Binance’s name, logo and claims to be an official download and registration portal. The recorded page title is “币安（Binance）App下载_安全注册入口（2026）” and the meta description promotes a Binance app download and registration. PhishDestroy first observed the domain on 2026-10-21.

How the scam works
Impersonation phishing sites copy the visual branding of a trusted service and present a login, registration or software‑download page to harvest credentials or deliver malicious software. Victims who enter Binance credentials or install the offered app may have their accounts compromised or devices infected.

Evidence
VirusTotal scanned the domain on 2026-10-21 with 92 engines and reported zero detections. Google Safe Browsing checked the same date and did not flag the site. External blocklists MetaMask and SEAL listed the domain (2 listings) and PhishDestroy’s internal list also flags it; OTX recorded four pulses referencing the domain on 2026-10-21. urlscan.io captured the site on 2026-10-21 and returned a malicious phishing verdict with a score of 100, tagging the Binance brand. Cloudflare Radar also recorded a malicious phishing verdict on 2026-10-21.

Infrastructure
The domain resolved to the recorded IP address 45.122.133.246. Server fingerprints show the site runs Ubuntu with Nginx; no registrar or CDN details are available.

What to do
Users should avoid entering Binance credentials or downloading the advertised app; if they have already done so, they should change their Binance password and review account activity. Defenders should block hello-binance.com.cn at network perimeters, monitor for connections to the recorded IP, and share the indicator with relevant threat‑intelligence platforms.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a15b77-a547-73be-bddf-ce0af1f38dab/
VirusTotal report: https://www.virustotal.com/gui/domain/hello-binance.com.cn
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=hello-binance.com.cn
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-21 01:12:52 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/Gv73QZcF/6508923d9690.png
  Captured: 2026-10-20 22:40:04 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a15b77-a547-73be-bddf-ce0af1f38dab.png
  Captured: 2026-10-20 22:40:04 UTC
  Source report: https://urlscan.io/result/01a15b77-a547-73be-bddf-ce0af1f38dab/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/11f99216-e1dc-4f0a-a5cd-cea19b0e5676.png
  Captured: 2026-10-20 22:41:02 UTC
  Source report: https://radar.cloudflare.com/scan/11f99216-e1dc-4f0a-a5cd-cea19b0e5676
  SHA-256: 7c9d54364d17d0569fa3ee28c6640b0d20690fda100350f37037feab57f41b29
- URLQuery: https://screenshots.phishdestroy.io/uq/bfc98fbd-d543-4d14-af79-a099443e8f00.png
  Source report: https://urlquery.net/report/bfc98fbd-d543-4d14-af79-a099443e8f00
  SHA-256: fe3f849ad33923424e7dd401c86d015d13b8d846dc8aee65523e3a1e4b05c1c4
- URLScan · 2026-10-20: https://screenshots.phishdestroy.io/us/01a15b7a-4d7c-74c8-9fbc-3e958a2352b8.png
  Captured: 2026-10-20 22:41:51 UTC
  Source report: https://urlscan.io/result/01a15b7a-4d7c-74c8-9fbc-3e958a2352b8/
  SHA-256: fb6c39be7b417634d6bf95beb22cf092fddc593ef73d5c5b768c3a797f33f42a

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T23:37:54Z",
        "uuid": "01a15b77-a547-73be-bddf-ce0af1f38dab",
        "scanned_at": "2026-10-20T22:38:57Z",
        "final_url": "https://hello-binance.com.cn/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://hello-binance.com.cn/",
                "from": "http://hello-binance.com.cn/",
                "status": 307
            }
        ],
        "ip": "45.122.133.246",
        "ips": [
            "45.122.133.246"
        ],
        "asns": [
            "153494"
        ],
        "countries": [
            "HK"
        ],
        "link_domains": [
            "www.bsmkweb.cc"
        ],
        "doc_hash": "cbd43cbb30edb44e44c196c192ab3afffe6ca0d3e86677281ef6fb879b91c4f2",
        "tls": {
            "san": [
                "app.binance-dl.com.cn",
                "app.binance-down.com.cn",
                "app.binance-help.com.cn",
                "app.binance-now.com.cn",
                "app.binance-reg.com.cn",
                "app.hello-binance.com.cn",
                "app.new-binance.com.cn",
                "app.real-binance.com.cn",
                "app.try-binance.com.cn",
                "app.use-binance.com.cn"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YE2",
            "subject": "binance-down.com.cn",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-18T16:14:13Z",
            "valid_from": "2026-10-20T16:14:14Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 2,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 97,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "binance"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Binance"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "nginx/1.24.0 (Ubuntu)",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T23:37:55Z",
        "uuid": "11f99216-e1dc-4f0a-a5cd-cea19b0e5676",
        "scanned_at": "2026-10-20T22:41:02Z",
        "final_url": "https://hello-binance.com.cn/",
        "status": 200,
        "history": [
            {
                "url": "https://hello-binance.com.cn/",
                "status": 200
            }
        ],
        "dom_hash": "c217dfd6dcd2ea922a2c867305e197edbee29c59332a965ad8e68dbab56a0863",
        "doc_hash": "cbd43cbb30edb44e44c196c192ab3afffe6ca0d3e86677281ef6fb879b91c4f2",
        "url_risks": [
            "Phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "Newly Seen Domains",
            "Security Risks",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "hello-binance.com.cn",
                "type": "A",
                "value": "45.122.133.246"
            }
        ],
        "dnssec_valid": false,
        "ip": "45.122.133.246",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "温州市中网计算机技术服务有限公司",
            "created": "2026-10-21T00:54:11Z",
            "expires": "2027-10-21T00:54:11Z",
            "nameservers": [
                "ns2.22.cn",
                "ns1.22.cn"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T01:07:39Z",
        "analysis_at": "2026-10-20T23:05:31Z",
        "stats": {
            "timeout": 0,
            "harmless": 56,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 36
        },
        "reputation": 0,
        "first_seen": "2026-10-20T17:18:24Z",
        "dns": [
            {
                "ttl": 600,
                "type": "SOA",
                "rname": "dnsadmin.22.cn",
                "value": "ns1.22.cn"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "45.122.133.246"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.22.cn"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.22.cn"
            }
        ],
        "dns_at": "2026-10-20T23:10:51Z",
        "jarm": "28d28d28d00028d00042d42d000000e1ea2a807a629b496b664cf07ad7c08d",
        "cert": {
            "san": [
                "app.binance-dl.com.cn",
                "app.binance-down.com.cn",
                "app.binance-help.com.cn",
                "app.binance-now.com.cn",
                "app.binance-reg.com.cn",
                "app.hello-binance.com.cn",
                "app.new-binance.com.cn",
                "app.real-binance.com.cn",
                "app.try-binance.com.cn",
                "app.use-binance.com.cn"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "6c8381e3e6f310eb5c80d6cb97f881e713a",
            "sha256": "8f463b8b8932257f9f305ccc24745529dc060ef130f59c3162be490b627fcf63",
            "subject": "binance-down.com.cn",
            "valid_to": "2027-01-18T16:14:13Z",
            "valid_from": "2026-10-20T16:14:14Z"
        },
        "whois": {
            "status": [
                "ok"
            ],
            "nameservers": [
                "ns1.22.cn",
                "ns2.22.cn"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-20T23:38:14Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "hello-binance.com.cn"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-20T22:43:44Z",
            "first": "2026-10-20T22:43:44Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 4054
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://hello-binance.com.cn/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 26
        },
        "social_tags": {
            "title": "币安（Binance）App下载_安全注册入口（2026）",
            "robots": "index, follow",
            "keywords": "币安官网,币安下载,币安App下载,币安注册,币安安卓版,币安官网入口",
            "description": "币安Binance官方App下载：安卓版APK一键下载，苹果版跳转App Store。2.5亿用户选择，机构级安全，毫秒级撮合。立即注册，填写邀请码DADAO享新人活动。"
        },
        "trackers": {
            "requests": 1
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 424,
                "tls": 276,
                "wait": 267,
                "connect": 258,
                "download": 0
            },
            "response_ms": 1225
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 8749,
            "co2_grams": 0.0003,
            "cleaner_than": 75
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "218.98.111.136",
                    "host": "ns1.22.cn"
                },
                {
                    "ip": "183.253.57.207",
                    "host": "ns2.22.cn"
                }
            ],
            "zone": "hello-binance.com.cn"
        },
        "location": {
            "ip": "45.122.133.246",
            "asn": "153494",
            "org": "Xrui Technology Limited",
            "city": "Tsim Sha Tsui",
            "country": "HK"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "binance-down.com.cn"
        },
        "dns": {
            "A": [
                "45.122.133.246"
            ],
            "NS": [
                "ns1.22.cn",
                "ns2.22.cn"
            ],
            "SOA": "{\"nsname\": \"ns1.22.cn\", \"hostmaster\": \"dnsadmin.22.cn\", \"serial\": 1792516223, \"refresh\": 3600, \"retry\": 300, \"expire\": 1209600, \"minttl\": 1800}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "45.122.133.246",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://hello-binance.com.cn"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Ubuntu",
                "Nginx"
            ]
        },
        "linked_pages": {
            "external": [
                "https://www.bsmkweb.cc/join"
            ],
            "external_count": 1,
            "internal_count": 1
        },
        "whois": {
            "registrar": "温州市中网计算机技术服务有限公司",
            "created": "2026-10-20T22:54:11Z",
            "expires": "2027-10-20T22:54:11Z",
            "status": [
                "ok"
            ],
            "nameservers": [
                "ns2.22.cn",
                "ns1.22.cn"
            ]
        },
        "headers": {
            "headers": {
                "server": "nginx/1.24.0 (Ubuntu)",
                "content-type": "text/html"
            }
        }
    }
}
```