accounts[.]maxweb[.]cab

This domain is flagged for elevated risk due to targeted brand impersonation, specifically mimicking the Binance cryptocurrency exchange login portal. The threat type involves a fake authentication interface designed to harvest user credentials, potentially enabling unauthorized access to financial accounts and subsequent asset theft. Analysis indicates this infrastructure was tailored for cryptocurrency users, a high-value target group for credential theft and fraudulent transactions. Infrastructure analysis reveals the domain accounts.maxweb.cab was registered on March 13, 2025, through Amazon Registrar, Inc. It currently resolves to the IP address 163.181.92.251, geolocated in Germany under autonomous system AS24429 (Zhejiang Taobao Network Co., Ltd.). The domain lacks an SSL certificate, increasing exposure to interception risks. Security vendors on VirusTotal flagged the domain with 14 out of 95 detections, while it appears on one security blocklist. The page title Log In | Binance confirms the impersonation attempt, and the domain was subsequently taken offline following detection. Mitigation for this threat type requires immediate action from both end users and organizational security teams. Users who may have interacted with the domain should reset Binance account credentials using a secure, verified connection and enable multi-factor authentication. Organizations should update web filtering rules to block the domain and associated IP address, while monitoring for credential reuse across other platforms. Security teams are advised to analyze network logs for connections to 163.181.92.251 or requests to accounts.maxweb.cab, particularly from endpoints handling cryptocurrency transactions. Given the domain's recent creation and lack of SSL, additional scrutiny of similarly structured domains registered through the same registrar is recommended.