bnbwallet[.]app

bnbwallet.app is currently flagged as a high‑risk brand‑impersonation site targeting Binance users. The site returns HTTP 200 and presents the page title “BNB Wallet – Secure BNB & BSC Token Storage for iOS”, indicating an attempt to lure victims into a cryptocurrency wallet service. The domain is listed as active on the report date and is classified under the cryptocurrency scam type. The hosting infrastructure is provided by Cloudflare, as evidenced by the presence of HSTS and a Google Trust Services / WE1 SSL certificate. The domain resolves to 185.158.133.1, an IP located in Poland and assigned to ASN 13335, the Cloudflare network. Four authoritative name servers—ns1jsv.name.com, ns2fgv.name.com, ns3bfm.name.com, and ns4cfn.name.com—serve the zone. Automated reputation scoring from Gridinsoft rates the domain at 0 out of 100, and VirusTotal reports nine detections out of ninety‑five scanners, confirming malicious activity. The indicator appears in a single AlienVault OTX pulse and is present on one public security blocklist. PhishDestroy has already added the domain to its blocklist, confirming that it is actively being used for phishing attempts. No additional public observations of the site’s content have been published, so the exact phishing flow and credential‑capture mechanisms remain unverified. Defenders should immediately block DNS resolution for bnbwallet.app and add the domain to email‑gateway deny lists to prevent delivery of malicious messages. Continuous monitoring of Cloudflare‑origin IP ranges and the listed name servers can help detect future repurposing of the infrastructure. Organizations that use Binance services should educate users about the legitimate Binance domain and advise verification of URLs before entering credentials. Threat‑intel teams are advised to enrich this indicator with payload samples if they become available, and to share any new artifacts with community feeds to improve detection coverage.