chainexelonfin[.]net

Analysis indicates that chainexelonfin.net was registered on 21 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. The domain resolves to 172.67.175.10, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The authoritative nameservers aisha.ns.cloudflare.com and dean.ns.cloudflare.com confirm the use of Cloudflare’s DNS service. No TLS certificate is presented, leaving the site without encryption. The site’s page title reads “Chain Exelon Fin - Resmi Platform | AI Ticaret 2025 | 10.000'den Fazla Yorum”, which does not contain direct references to the targeted brand, but the intelligence tags the domain as a brand‑impersonation campaign against Binance.

VirusTotal has recorded 15 detections out of 93 scanners, indicating that a minority of security engines flag the domain as malicious. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. Google Safe Browsing classifies the URL as a social‑engineering threat. Independent blocklists from PhishDestroy, MetaMask, and SEAL have already added the domain to their deny lists, and it appears on three additional security blocklists. The current operational status is offline, which may be temporary or intentional for takedown avoidance.

The available data confirm the domain’s involvement in a Binance impersonation scheme, but the exact content served, such as login forms or credential‑harvesting pages, has not been captured. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑activation of the IP address, and include the domain in threat‑intel feeds. Additional sandbox analysis of the HTTP response, if the site returns, would be required to fully characterize the payload and any potential redirects. Until such evidence is gathered, the domain should be treated as high‑risk and incorporated into existing security controls.