shib-82e[.]pages[.]dev

Analysis of shib-82e.pages.dev indicates an active brand‑impersonation infrastructure targeting Binance. The domain was registered on December 5 2023 through Cloudflare, Inc. and resolves to 104.21.64.1, an address owned by AS13335 (Cloudflare) located in the United States. Both authoritative nameservers – cecelia.ns.cloudflare.com and ken.ns.cloudflare.com – belong to Cloudflare, confirming that the site is fronted by the provider’s CDN and benefits from Cloudflare‑issued SSL issued by Google Trust Services (WE1). The HTTP response returns status 200 and the page title is “MONKEDEX,” a name unrelated to Binance, suggesting the site is being used to host malicious content rather than a legitimate service. Automated scans have identified the presence of common front‑end libraries such as jsDelivr, cdnjs, and the use of HSTS and HTTP/3, all typical of legitimate CDN‑hosted sites but also frequently leveraged by phishing operators to increase perceived legitimacy. The domain appears on three independent blocklists (PhishDestroy, ScamSniffer, Enkrypt) and receives extremely low reputation scores (Scamadviser 11/100, Gridinsoft 0/100). VirusTotal records show the URL has been submitted to 93 scanners without any detections, but the absence of a detection does not constitute proof of safety. No public payload or page content has been disclosed, so the exact phishing vector remains unknown. Given the confirmed impersonation of Binance, the active status, and the low trust metrics, defenders should treat shib-82e.pages.dev as malicious. Recommended actions include adding the domain to DNS and proxy blocklists, monitoring for any new sub‑domains or related CNAME records, and alerting users about unsolicited communications that reference Binance and link to this domain.