binance-spotify[.]com[.]cn

PhishDestroy identifies binance-spotify.com.cn as a confirmed brand impersonation threat targeting Binance, the cryptocurrency exchange. The domain masquerades as a legitimate Binance platform, using a page title that reads 'binance-币安下载官方app-币安交易所官网' to trick users into downloading fake applications or revealing credentials. This domain was created on May 16, 2026, and was registered through 北京新网数码信息技术有限公司, a Chinese registrar. It resolved to IP address 154.31.133.82 and was issued an SSL certificate by Let's Encrypt (R13), which adds a false sense of security to visitors.

Technical indicators are severe: VirusTotal flagged the domain with a score of 14 out of 95 security vendors, and it appears on 2 security blocklists. The domain was designed to steal sensitive information from cryptocurrency users, potentially leading to financial loss. Google Safe Browsing likely flagged it as deceptive, though the domain is now offline. The use of a Let's Encrypt certificate is common among phishing sites to appear legitimate.

As of now, the domain has been taken offline, but the risk remains for users who may have already interacted with it. PhishDestroy recommends that users who visited the site change their Binance account passwords immediately and enable two-factor authentication. Any downloaded files should be scanned with antivirus software. Users should always verify domain names carefully, as this site combined 'binance' with 'spotify' to appear benign. Monitoring for related domains is advised, as threat actors often create multiple variations after takedowns.