bnb-sand-usdt[.]netlify[.]app

This domain, bnb-sand-usdt.netlify.app, is flagged as a high-risk cryptocurrency phishing site targeting users of decentralized finance (DeFi) platforms. Analysis indicates the domain mimics legitimate Binance Smart Chain (BSC) and USDT token interactions, likely deploying a wallet-draining kit to siphon funds from unsuspecting victims. The infrastructure appears designed to exploit users searching for BNB or SAND token transactions, redirecting them to fraudulent interfaces that harvest private keys or seed phrases. Infrastructure analysis reveals the domain was registered through Netlify on May 19, 2026, with no legitimate association to the Binance or The Sandbox ecosystems. VirusTotal detection metrics show 4 out of 95 security vendors have flagged the domain as malicious, while it appears on 2 independent security blocklists. The domain resolves to Netlify’s hosting infrastructure, with no associated IP address publicly disclosed. Google Safe Browsing (GSB) status remains unconfirmed, but the domain is actively blocked by at least two specialized anti-phishing tools. No legitimate SSL certificates or historical WHOIS records provide additional context, reinforcing its transient, malicious nature. As of the latest assessment, bnb-sand-usdt.netlify.app remains active and unmitigated, posing a persistent risk to users engaging with cryptocurrency transactions. No takedown requests or registrar interventions have been observed, and the domain continues to resolve without interruption. Users are advised to treat the domain as hostile and avoid interaction entirely. Organizations should update blocklists to include this domain and monitor for related subdomains or IP associations. Given the domain’s targeting of DeFi users, heightened scrutiny of wallet addresses and transaction requests originating from this infrastructure is recommended.