veganfoodtours[.]fr

Analysis indicates that www.veganfoodtours.fr is an active brand‑impersonation site targeting Binance users. The domain was registered on 16 May 2026 through Dynadot Inc and resolves to the Cloudflare‑owned address 188.114.96.3 located in Canada. DNS resolution is served by arvind.ns.cloudflare.com and lana.ns.cloudflare.com, confirming the use of Cloudflare’s infrastructure. HTTP requests return a 301 redirect and the site presents a valid TLS certificate issued by Let’s Encrypt (E7). Page metadata shows the title “vegan food tours – Home”, suggesting no direct reference to Binance in the visible content, and no additional page content has been examined. Detected client‑side components include Tripadviser.Widget, jQuery, Facebook Pixel, Cloudflare Browser Insights, and support for HTTP/3, all typical of a content‑rich site hosted behind Cloudflare. VirusTotal scans report 2 of 92 security vendors flagging the domain, and the domain appears on a single security blocklist. The site is currently blocked by PhishDestroy, confirming that at least one sinkhole is active. The overall risk rating is high, reflecting the credential‑phishing intent. Uncertainty remains regarding the exact phishing workflow, such as login capture mechanisms or payload delivery, because the page content has not been captured. Defenders are advised to block the domain and its resolving IP at perimeter filters, monitor DNS queries for the associated Cloudflare nameservers, and enforce multi‑factor authentication for Binance accounts. Further investigation should include retrieval of the landing page HTML to confirm the presence of credential‑collection forms and to assess any additional malicious scripts.