binance-cloudserver[.]online

Analysis of the domain binance-cloudserver.online confirms active impersonation of the Binance cryptocurrency exchange, classified as a high-risk brand impersonation threat. The domain was registered on February 21, 2026, through VIRTUA DRUG Kutatási Szolgáltató Korlátolt Felelősségű Társaság, a registrar not historically associated with legitimate Binance infrastructure. Current nameserver assignments (ns1.dns-redirect.com and ns2.dns-redirect.com) are consistent with known redirection services used in fraudulent campaigns, though not exclusively malicious. The domain resolves to IP address 163.61.188.2, hosted on AS153568 (NEW DHAKA HARDWARE), an autonomous system with limited prior association with verified Binance endpoints. A 301 HTTP redirect is observed, suggesting the domain may be configured to forward visitors to another malicious or spoofed resource. The SSL certificate (R13) does not match Binance's standard certificate authority patterns, further indicating a lack of legitimate affiliation. Security vendor detection on VirusTotal shows 12 out of 95 engines flagging the domain as malicious, while PhishDestroy has explicitly blocked it. The domain appears on one additional security blocklist. Despite these indicators, the page title (Buy binance-cloudserver.online – Premium Expired .online Domain on GoDaddy | Exp) suggests the domain may still be listed for sale, though this could also serve as a decoy to evade detection. Defenders should treat this domain as actively malicious and prioritize blocking at DNS, proxy, and endpoint levels. The combination of brand impersonation, cryptocurrency scam classification, and low Gridinsoft trust score (0/100) warrants immediate action. Further investigation into associated IP addresses and redirect targets is recommended to identify additional compromised infrastructure.