binanceoracle[.]pro

The domain binanceoracle.pro was observed on July 12, 2026 and is classified as a high‑risk brand‑impersonation campaign targeting Binance. The page title returned by the server is “Create a free account | Binance”, which aligns with the declared brand target. The domain is currently active and listed as a cryptocurrency‑related scam. Infrastructure analysis shows the domain resolves to the IPv4 address 18.245.46.63, hosted within the Amazon.com, Inc. network (AS16509) and geolocated to Germany. DNS resolution is provided by ns1.badgerdns.com and ns2.badgerdns.com. The web server reports an HTTP 302 redirect and presents a TLS certificate issued by Let’s Encrypt (R12) that covers the primary domain. Detected technologies include Nginx, OpenResty, Google Cloud, and Google Cloud CDN. Threat intelligence indicates that two of ninety‑five VirusTotal security vendors have flagged the domain, and it appears on a single public blocklist maintained by PhishDestroy. The domain carries a Gridinsoft trust score of 0 out of 100, reinforcing the malicious assessment despite the low detection ratio on VirusTotal. While the observed indicators confirm a functional phishing infrastructure, the content of the landing page beyond the title has not been independently verified. Defenders should prioritize blocking the domain and its associated IP address at network perimeter devices, enforce TLS inspection to capture the redirect, and monitor for any additional subdomains or similar registrations from CommuniGal Communication Ltd. Implementing DNS sinkholing for the authoritative nameservers can disrupt future resolution attempts, and user education to verify URLs against official Binance domains is advised.