binanceus[.]cc

This domain, binanceus.cc, is confirmed as a high-risk brand impersonation site targeting Binance, a major cryptocurrency exchange. Analysis indicates the site employs social engineering tactics, likely to facilitate credential theft or unauthorized fund transfers. The page title 'Scalping' suggests an attempt to lure users with promises of high-frequency trading opportunities, a common tactic in crypto-related fraud. No direct evidence of a crypto drainer kit was observed, but the infrastructure and impersonation techniques align with known credential harvesting campaigns. Infrastructure analysis reveals the domain was registered on March 14, 2026, through Cloudflare, Inc., and resolves to the IP address 102.204.222.8. The site uses a Let's Encrypt SSL certificate and employs technologies such as Vue.js, Nginx, HSTS, and HTTP/3. Google Safe Browsing flags the domain with the label 'SOCIAL_ENGINEERING,' and it appears on three security blocklists. VirusTotal reports 18 out of 95 security vendors flagging the domain as malicious, further corroborating its fraudulent nature. The domain is currently offline, likely due to takedown actions by security providers or the registrar. However, the risk of re-emergence under a similar domain or infrastructure remains high. Users who interacted with this domain should immediately revoke any active sessions, reset credentials, and monitor accounts for unauthorized transactions. Organizations are advised to block the domain and associated IP at the network level and update detection rules to include the observed indicators of compromise (IOCs).