binance-wallet[.]at

The domain binance-wallet.at, which impersonates Binance, has been flagged as malicious by 11 out of 91 vendors on VirusTotal. Despite being taken down, its previous activity targeted cryptocurrency users by mimicking a legitimate platform. The site was hosted on an IP address associated with Proton66 OOO in Russia, and it utilized an SSL certificate issued by Let's Encrypt.

The page title misleadingly referenced Bitget, another cryptocurrency platform, suggesting a sophisticated attempt to confuse potential victims. The domain was created on April 29, 2026, indicating a future registration date, which could point to a clerical error or deliberate obfuscation tactic by the threat actors. This domain was listed on public blocklists including PhishDestroy, MetaMask, and SEAL, highlighting its malicious intent.

Phishing domains like binance-wallet.at exploit the critical window between domain registration and detection by antivirus databases, typically 24-72 hours. PhishDestroy's early detection capabilities allow for identification during this vulnerable period, ensuring threats are mitigated before they can cause widespread harm. The domain's takedown reduces immediate risk, but its existence underscores the ongoing threat posed by phishing campaigns targeting cryptocurrency users.