bing-binance[.]com[.]cn

This domain, bing-binance.com.cn, is identified as a credential harvesting platform targeting users of the Binance cryptocurrency exchange. Analysis indicates the site employs brand impersonation tactics, presenting itself as an official Binance registration portal with a page title in Chinese: "币安注册｜币安｜币安官网｜币安下载｜新用户快速开户指南." The domain mimics Binance’s branding to deceive users into submitting sensitive account details, including login credentials and two-factor authentication codes, which are then harvested for unauthorized access or financial theft. Infrastructure analysis reveals multiple technical indicators of compromise. The domain is registered through Web Commerce Communications Limited and resolves to the IP address 104.21.78.55. It was created on June 09, 2026, though this date may reflect falsified registration data. Security vendor detections on VirusTotal report 3 out of 95 engines flagging the domain as malicious. The domain appears on four security blocklists, including MetaMask and PhishDestroy, and is referenced in two AlienVault OTX threat intelligence pulses. The SSL certificate is issued by Google Trust Services, a common tactic to lend false legitimacy to phishing sites. As of the latest assessment, bing-binance.com.cn has been taken offline, reducing immediate exposure. However, residual risk persists due to the domain’s prior activity and potential for re-emergence under altered infrastructure. Organizations and users are advised to block the domain and its associated IP at the network level, monitor for related indicators of compromise, and verify all Binance-related communications through official channels. Security teams should treat any prior interaction with this domain as a potential credential compromise event and initiate password resets and account audits for affected users.