binance-verify[.]com

This domain is flagged as a high-risk credential phishing infrastructure specifically targeting Binance users. Analysis indicates the site is designed to harvest login credentials, API keys, or two-factor authentication codes under the guise of account verification or security updates. The domain exhibits multiple indicators of malicious intent, including brand impersonation and a lack of legitimate business association with the targeted entity. Infrastructure analysis reveals the following technical details: the domain binance-verify.com was registered on November 18, 2025, through Sav.com, LLC. It currently resolves to the IP address 144.172.112.30 and is secured with a Let's Encrypt SSL certificate. The page title, 'binance-verify.com — Domain welcome page for,' suggests either a placeholder or a minimalistic landing page intended to evade detection. VirusTotal reports that 12 out of 95 security vendors have flagged this domain as malicious, indicating moderate but growing detection coverage. No legitimate business or operational context linking this domain to Binance has been identified. Mitigation steps for this specific threat type include immediate blacklisting of the domain and associated IP address (144.172.112.30) at the network perimeter. Security teams should deploy indicators of compromise (IOCs) to endpoint detection and response (EDR) systems and web filtering solutions to block access. Users should be educated to recognize phishing attempts, particularly those mimicking Binance verification processes, and instructed to verify domain authenticity via official channels. Organizations should monitor for credential reuse or unauthorized access attempts originating from this infrastructure, as harvested credentials may be exploited in follow-on attacks.