binancebr[.]com

On July 23 2026, binancebr.com was observed hosting a fraudulent page titled “Create a free account | Binance”. The site is registered through Vantage of Convergence (Chengdu) Technology Co., Ltd. and was created on August 08 2025. Infrastructure analysis shows the domain resolves to 18.245.46.77, an Amazon Web Services address located in Germany and belonging to AS16509 Amazon.com, Inc. The hosting stack includes Amazon CloudFront, and the domain uses Cloudflare nameservers carlos.ns.cloudflare.com and elinore.ns.cloudflare.com. The TLS certificate is issued by Google Trust Services under the WE1 root, indicating a valid‑looking HTTPS connection. HTTP requests return status 200, confirming the page is actively served.

Reputation services rate the domain poorly: Scamadviser assigns a trust score of 25/100, Gridinsoft rates it 0/100, and the site appears on one security blocklist. PhishDestroy has already blocked the domain, and VirusTotal reports that one of ninety‑five scanning engines flagged the domain as malicious. The page title explicitly references Binance, and the threat type is classified as a crypto scam, confirming the intent to impersonate the Binance brand. While the exact content of the landing page has not been publicly disclosed, the presence of a Binance‑related title and the classification as a crypto scam strongly suggest credential‑harvesting or fraudulent account creation attempts.

Defenders should add binancebr.com to URL filtering and domain‑blocking lists, monitor DNS queries for the resolved IP, and enforce TLS inspection to detect any malicious payloads. Additional scrutiny of outbound traffic from internal hosts that resolve to the AWS IP range is advised. Continuous monitoring of the CloudFront distribution and Cloudflare name‑server changes is recommended, as threat actors often pivot infrastructure. The current evidence confirms an active, high‑risk impersonation campaign targeting Binance users.