binance-api[.]app

Analysis of binance-api.app, observed on July 24, 2026, indicates that the domain is being used for a Binance impersonation campaign classified as a crypto‑scam. The site resolves to the IPv4 address 35.157.26.135, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in Germany. Hosting on Amazon infrastructure is common for both legitimate services and malicious actors, so the IP alone does not confirm intent, but the association with a known blocklist and multiple vendor detections raises concern. The domain is registered through Name.com, Inc., and the authoritative name servers are dns1.p05.nsone.net through dns4.p05.nsone.net. The TLS certificate presented is a DigiCert Global G2 RSA SHA256 2020 CA1 certificate issued by DigiCert Inc., a reputable CA.

The presence of a valid certificate does not mitigate the risk; it is often leveraged by threat actors to increase perceived legitimacy. Content analysis shows the page title “Access Code – Binance Guard,” which directly references Binance and suggests a credential‑capture motive. The site currently returns HTTP 404, and the hosting provider has taken the domain offline, as indicated by the “taken offline” status. Despite the offline state, the domain appears on at least one security blocklist and has been flagged by six of ninety‑five VirusTotal scanners, confirming that multiple security vendors have identified it as malicious. Defenders should treat any traffic to binance-api.app as hostile.

Blocking the domain at the DNS or proxy level is recommended, as is adding the associated IP address 35.157.26.135 to deny lists. Email security gateways should be updated to flag messages that reference “Binance Guard” or contain URLs matching the domain pattern. Incident response teams should search for any credential submissions that may have been captured before the takedown, and users should be instructed to verify any Binance‑related communications through official channels only.