binanceflashusdt[.]info

On 12 July 2026 analysts observed the domain binanceflashusdt.info actively hosting a site that claims to sell USDT instantly. The page title returned by the server is “Flash USDT - Sell Your USDT Instantly”, and the site is classified as a high‑risk brand‑impersonation campaign targeting the Binance brand. The domain remains active as of the report date.

The domain resolves to the IPv4 address 69.10.62.204, which belongs to AS19318 Interserver, Inc. and is geolocated in the United States. HTTP requests receive a 200 OK response, indicating that the server is delivering content. The TLS certificate is issued by Let’s Encrypt (R13), providing a valid HTTPS endpoint despite the malicious purpose. Authoritative nameservers listed for the zone include ns1cny.name.com, ns2lns.name.com, ns3bfm.name.com, and ns4bfy.name.com, all of which are typical of domains registered through Name.com, Inc.

Reputation services flag the domain heavily. VirusTotal records ten out of ninety‑five security vendors marking the domain as malicious, and Gridinsoft assigns a trust score of 0 out of 100. The domain appears on at least one public security blocklist and has been actively blocked by the PhishDestroy mitigation service. These signals collectively reinforce the high‑risk rating assigned to this infrastructure.

While the page title and registration details are confirmed, the exact content of the landing page has not been publicly disclosed, limiting visibility into the specific user‑experience components employed. Defenders should prioritize blocking the domain at network perimeter devices, updating URL filtering feeds, and monitoring for any outbound connections to the resolved IP address. Continuous observation is advised to detect any changes in hosting or additional malicious payloads that may be introduced.