binance-bot[.]cfd

This domain, binance-bot.cfd, poses a direct threat to cryptocurrency users by impersonating the Binance trading platform. Analysis indicates the site was designed to harvest login credentials, API keys, and two-factor authentication codes from victims under the guise of a trading bot service. The domain specifically targets users seeking automated trading tools, exploiting trust in the Binance brand to facilitate unauthorized account access and fund theft. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on April 08, 2026, through Web Commerce Communications Ltd, a registrar frequently associated with fraudulent domains. VirusTotal detection shows 18 out of 95 security vendors flagging the domain as malicious, with Google Safe Browsing specifically categorizing it as phishing. The site resolves to IP address 94.154.35.90 (NL), hosted by an individual entrepreneur with previous associations to suspicious infrastructure. Notably, the domain lacks any SSL certificate, exposing all transmitted data to interception, and appears on one security blocklist. Users who visited binance-bot.cfd should immediately take corrective actions. First, revoke any API keys or session tokens created during the visit. Second, change Binance account passwords using a device not previously connected to this domain. Third, enable hardware-based two-factor authentication if not already active. Monitor account activity for unauthorized transactions, particularly withdrawals or trades. The domain's current offline status does not eliminate risk, as harvested credentials may be stored for future exploitation. Organizations should add 94.154.35.90 to network blocklists and alert employees about this specific credential harvesting campaign.