binance-secure[.]app

This domain, binance-secure.app, operates as a brand impersonation threat targeting Binance users through credential theft mechanisms. Analysis indicates the site mimics legitimate Binance authentication portals, likely designed to harvest login credentials or facilitate unauthorized account access. The page title 'Success!' suggests an attempt to mislead users into believing a transaction or verification process has completed, potentially increasing the likelihood of credential submission. Infrastructure analysis reveals the domain was registered on August 05, 2025, through Web Commerce Communications Limited. It resolves to the IP address 188.114.97.3 and employs Cloudflare services alongside HTTP/3 protocols. Detection metrics show the domain is flagged by 3 out of 95 security vendors on VirusTotal and appears on three independent security blocklists. Additional threat intelligence confirms its presence in one AlienVault OTX pulse, with a Gridinsoft trust score of 0/100, further corroborating its malicious classification. Users who visited binance-secure.app should immediately revoke any active sessions associated with Binance or related services. Credentials entered on the site must be considered compromised and changed across all platforms where identical or similar passwords were used. Monitoring for unauthorized transactions or account modifications is strongly advised. If financial interactions occurred, affected parties should report the incident to relevant authorities and consider freezing associated assets to prevent further exploitation.