makingmoneyai[.]top

makingmoneyai.top is currently offline but historical analysis shows it was used for brand impersonation targeting Binance users. The domain was registered through Gname.com Pte. Ltd. on May 08, 2025 and delegated to the Cloudflare nameservers cass.ns.cloudflare.com and kianchau.ns.cloudflare.com. DNS resolution points to 104.21.49.147, an IP owned by AS13335 Cloudflare, Inc., located in the United States. No TLS certificate was observed for the host, indicating that any web service would have been delivered over plain HTTP.

The site’s HTML title was reported as “FUNDEDNEX,” which does not directly reference Binance but was flagged as a brand‑impersonation page. Reputation scoring from Gridinsoft assigned a trust score of 1 out of 100, reflecting extreme suspicion. VirusTotal analysis recorded five positive detections out of ninety‑five scanned engines, confirming malicious classification by multiple vendors. The domain appears on two public blocklists and has been forcibly taken down by the PhishDestroy and ScamSniffer takedown services.

Because the infrastructure relied on Cloudflare’s CDN, the underlying IP may be shared with unrelated legitimate sites, complicating direct sink‑holing. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑registration attempts, and add the IP address 104.21.49.147 to reputation‑based deny lists, while recognizing that Cloudflare’s shared hosting may produce false positives. Ongoing threat‑intel feeds should be consulted for any resurgence of the same kit or page title. Until further evidence emerges, the primary mitigation is to keep the domain and associated IP on blocklists and to educate users about unsolicited Binance‑related communications.