binanceearn[.]net

This domain, binanceearn.net, is flagged as an active brand impersonation threat targeting Binance users through credential harvesting techniques. Analysis indicates the domain is designed to mimic legitimate Binance earning or investment pages, likely distributing phishing content to capture cryptocurrency wallet credentials, API keys, or two-factor authentication codes. No specific drainer kit signatures have been identified in available telemetry, though the infrastructure aligns with common phishing-as-a-service patterns. Infrastructure analysis reveals the domain was registered on June 11, 2026, through Gname.com Pte. Ltd., an registrar frequently observed in malicious domain registrations. It resolves to IP address 104.21.59.196, a Cloudflare proxy endpoint commonly exploited to obfuscate hosting origins. VirusTotal detection metrics show 10 out of 95 security vendors flag the domain as malicious, while AlienVault OTX records its presence in four distinct threat intelligence pulses. The domain appears on one security blocklist and is actively blocked by PhishDestroy. No Google Safe Browsing (GSB) listing is currently recorded, suggesting either recent deployment or evasion of automated crawlers. As of the latest assessment, binanceearn.net remains operational and unseized, maintaining elevated risk due to its direct targeting of cryptocurrency users. Recommended response actions include immediate blacklisting at network and endpoint levels, credential reset advisories for potentially exposed users, and monitoring for related domains registered through the same registrar. Despite existing detections, the domain's continued resolution and lack of takedown indicate persistent threat exposure. Organizations should treat any interaction with this domain as a high-confidence compromise indicator and investigate associated network traffic for follow-on activity.