binance636[.]com

On 23 July 2026 analysts observed the domain binance636.com, registered on 9 May 2025 through GoDaddy.com, LLC. The domain resolves to IP 43.248.173.26, which belongs to AS4907 BGPNET PTE. LTD. located in Hong Kong. Nameserver records list ns47.domaincontrol.com and ns48.domaincontrol.com, both standard GoDaddy name servers. The TLS certificate presented is issued by GoDaddy.com under the GoDaddy TLS Intermediate CA DV - R1v1 chain, indicating a legitimate certificate issuance but not mitigating the malicious intent.

The page title reported is “币安交易所app下载 - 专业的数字货币交易平台导航”, which directly references the Binance brand and suggests a cryptocurrency‑related offering. The intelligence tags the site as a brand impersonation targeting Binance and classifies the activity as a Crypto Scam. Gridinsoft assigned a trust score of 0 out of 100, confirming the domain as fully untrusted. VirusTotal scans flagged the domain in three of ninety‑five vendor engines, and the domain appears on a single security blocklist, currently blocked by PhishDestroy.

The overall risk level is marked elevated, and the domain status is offline at the time of reporting. While the surface‑level indicators such as registration, hosting, and SSL are typical of many legitimate services, the combination of a zero trust score, brand‑specific page title, and multiple vendor detections point to a deliberate impersonation campaign. Defenders should continue to block the domain at DNS and gateway layers, monitor the hosting IP for further malicious activity, and add the domain to internal threat intel feeds. Additional analysis of the site content, HTTP response headers, and any associated URLs would be required to fully characterize the payload or credential‑harvesting mechanisms, but the current evidence is sufficient to treat binance636.com as a confirmed brand‑impersonation phishing vector.