accounts[.]maxweb[.]red

On 23 July 2026 the domain accounts.maxweb.red was observed to host a credential‑collection page that mimics Binance, as indicated by the page title “Log In | Binance”. The site resolved to the IPv4 address 43.159.94.13, which is allocated to the ACE‑SG network (ASN 139341) in Singapore. Registration information links the domain to the ACE‑SG registrar, but the authoritative nameservers could not be retrieved (NS_NOT_FOUND). No TLS certificate was presented, leaving the HTTP connection unencrypted.

Reputation services rate the domain extremely poorly: Gridinsoft assigns a trust score of 1 / 100, and Scamadviser also reports 1 / 100. Malware and phishing aggregators have flagged the domain; it appears on one blocklist and is currently blocked by PhishDestroy. VirusTotal analysis shows that 14 out of 95 scanned security vendors flagged the domain as malicious, reinforcing the suspicion of a crypto‑related phishing operation. The public status of the domain is listed as offline, suggesting that the site may have been taken down or is no longer serving content, but the underlying infrastructure—IP address, hosting ASN, and lack of SSL—remains observable and could be reused.

Defenders should continue to monitor the IP 43.159.94.13 and ASN 139341 for any resurgence of phishing activity, enforce blocklisting of the domain in corporate web filters, and educate users that any unsolicited request to log into Binance that originates from this domain is fraudulent. Because the site’s content has not been captured, further forensic analysis of the landing page is not possible at this time, and the absence of nameserver data limits attribution of the registration entity. Ongoing vigilance is recommended, especially for organizations that handle cryptocurrency accounts, to prevent credential compromise.