farossonglobaltrade[.]ltd

farossonglobaltrade.ltd was registered on 25 November 2024 through Ultahost, Inc. The domain resolves to IP 198.12.66.123, which belongs to AS36352 (HostPapa) located in the United States. Authoritative nameservers are ns1.dnsperfect.net and ns2.dnsperfect.net, and the MX record points to the same domain, indicating self‑hosted mail. The site serves content over HTTPS using a Let's Encrypt R13 certificate and returns HTTP 200. Scanning by VirusTotal shows 13 of 95 engines flagging the host, and Scamadviser assigns a trust score of 1/100, while Gridinsoft rates it 6/100, reflecting a high likelihood of malicious activity. The page title reported is “farosson Global Trade”. The observed web stack includes PHP, Bootstrap, jQuery, Google Hosted Libraries, Lightbox, Smartsupp, GetButton, and embedded YouTube elements. The domain is listed as a Binance impersonation campaign and is classified as a crypto‑scam. It is currently blocked by PhishDestroy and appears on one additional security blocklist. Active status indicates the site remains reachable. Analysis indicates the infrastructure is typical of low‑cost phishing kits: recent registration, cheap hosting, self‑managed MX, and a generic TLS certificate. No additional content analysis is available, so the exact lure or credential‑capture mechanisms cannot be confirmed. Defenders should add the domain and its IP address to network‑level blocklists, update email security gateways to reject mail from the domain, and monitor for similar patterns in new registrations using the same registrar or nameservers. Users should be warned that any unsolicited communication referencing Binance from this domain is fraudulent.