binance198[.]com

Analysis of binance198.com, observed on July 23, 2026, shows a high‑risk brand‑impersonation campaign targeting Binance users. The domain was registered on March 17, 2025 and resolves to the IP address 154.201.183.48, which is situated in Hong Kong and belongs to ASN 132839 (POWER LINE DATACENTER). Hosting is provided by a provider that runs Nginx and serves content over HTTPS using a Let’s Encrypt R12 certificate; the site also employs HSTS, Bootstrap, jQuery, Swiper and OWL Carousel libraries. DNS resolution uses the nameservers a9.share-dns.com and b9.share-dns.net, and the registrar listed is InterNetX GmbH. The HTTP response returns status code 200, indicating the site is actively serving pages.

The page title, "Binance 币安 ——比特币、以太币等加密货币交易平台2025," explicitly references the Binance brand and cryptocurrency trading, confirming the campaign’s intent to masquerade as a legitimate exchange. Threat intelligence flags the domain as a crypto‑scam, and it appears on at least one security blocklist, with PhishDestroy already blocking it. Reputation services assign very low trust scores: Scamadviser rates the site 21 / 100 and Gridinsoft rates it 0 / 100, reflecting poor credibility.

VirusTotal analysis shows that one of ninety‑five security vendors flagged the domain, providing an additional indicator of malicious intent. The combination of brand impersonation, low trust metrics, a single vendor detection, and active hosting suggests the site is being used to lure victims for credential harvesting or financial fraud. Defenders should update URL filtering and domain‑block lists to include binance198.com, enforce outbound DNS monitoring for queries to its IP range, and consider adding the domain to endpoint protection signatures. Given the active HTTPS service and legitimate‑looking certificate, TLS inspection may be required to uncover any payloads delivered over encrypted channels.