binancebp20[.]pages[.]dev

The domain binancebp20.pages.dev was identified as a phishing infrastructure impersonating Binance, a cryptocurrency exchange platform. This domain was actively engaged in brand impersonation, a tactic used to deceive users into divulging sensitive credentials or financial information. As of the latest assessment, the domain has been taken offline, though prior activity remains a concern for retrospective analysis. Infrastructure analysis reveals the domain was registered through Cloudflare Pages on March 25, 2026, and resolved to the IP address 188.114.97.3. It was flagged by 3 of 95 security vendors on VirusTotal, indicating moderate detection coverage. The domain appeared on one security blocklist and received a trust score of 0 out of 100. The SSL certificate was issued by Google Trust Services, a common feature in both legitimate and malicious domains. The page title, 'Suspected phishing site | Cloudflare,' further corroborates its association with deceptive activity. Current status indicates the domain is offline, reducing immediate risk to end users. However, organizations should monitor for re-emergence or similar infrastructure leveraging the same registrar or IP range. Security teams are advised to update blocklists with this domain and associated indicators, including the IP address and SSL certificate issuer. End users should be educated on recognizing brand impersonation tactics, particularly in the cryptocurrency sector, and encouraged to verify domain authenticity before interacting with financial platforms.