jp[.]binance[.]bitlnb[.]cc

The domain jp.binance.bitlnb.cc is currently listed as offline but exhibits multiple indicators of malicious activity consistent with a brand‑impersonation and tech‑support scam targeting Apple users. Infrastructure analysis shows the domain resolves to the IP address 156.225.30.207, which belongs to AS401701 operated by Cognetcloud Inc. and is geolocated in Hong Kong. The domain was registered on February 21, 2026, a recent creation date that aligns with the rapid deployment of fraudulent sites. The SSL certificate presented is identified as R13, suggesting the use of a freely‑issued or low‑cost certificate without strong validation.

The page title returned from the server is "Binance," yet the intelligence flags the site as impersonating Apple, indicating a mismatch between visible branding and the advertised target. VirusTotal reports that 15 of 93 security scanners flag the domain as malicious, demonstrating a moderate consensus among detection engines. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing its classification as a threat. Reputation services assign extremely low trust scores: Scamadviser rates the site 1 out of 100 and Gridinsoft assigns 0 out of 100, reflecting a high likelihood of fraudulent behavior.

The observed scam type is a tech‑support scam, which typically involves social‑engineering tactics to convince victims that their devices are compromised and require remote assistance. While the exact content of the site beyond the page title has not been publicly captured, the combination of a newly created domain, mismatched branding, low reputation scores, multiple vendor detections, and blocklist inclusion provides sufficient evidence for security teams to treat the domain as hostile. Defenders should continue to block the domain at network perimeters, update intrusion‑prevention signatures, and monitor for any resurgence of the domain or related infrastructure.