mining-deer[.]club

Analysis of mining-deer.club shows a newly observed brand‑impersonation campaign targeting Binance users. The domain was registered on 27 September 2025 through Dominet (HK) Limited and is hosted on Cloudflare’s AS13335 network, resolving to IP 172.67.188.62 located in the United States. DNS resolution utilizes the Cloudflare nameservers jean.ns.cloudflare.com and ruben.ns.cloudflare.com. No TLS certificate is present, indicating the site is served over HTTP only, which is atypical for legitimate Binance services and lowers user confidence. The page title returned by the server is 【New message】DeerMining, offering no direct indication of the content or functionality of the landing page; the exact page layout and credential capture mechanisms have not been publicly disclosed.

Security assessments reveal a low trust rating from Gridinsoft (0 / 100) and a classification as a wallet/seed phishing operation. VirusTotal scans have recorded detections from 12 of 95 scanning vendors, suggesting a moderate level of malicious payload or phishing behavior identified by multiple engines. AlienVault OTX cites the domain in a single threat‑intel pulse, reinforcing its presence in the broader threat‑sharing community. The domain appears on one public blocklist and has been actively blocked by the PhishDestroy anti‑phishing service, confirming that reputable defensive platforms recognize it as malicious.

Given the lack of an SSL certificate, the presence of a brand‑impersonation tag, and the detection metrics, the domain presents an elevated risk to any user who might interact with it, especially those seeking Binance services. Defenders should continue to block the domain at perimeter filters, update URL‑filtering and DNS‑sinkhole rules, and monitor for any related C2 infrastructure using the associated IP address. Analysts should also watch for any future re‑registration attempts or changes in hosting that could indicate a shift in operational tactics.