binanceii[.]com

Analysis indicates that binanceii.com is an active brand-impersonation domain targeting Binance, the cryptocurrency exchange. The domain was registered on October 19, 2025, through Gname.com Pte. Ltd. and currently resolves to the IP address 35.220.194.52. As of July 12, 2026, it remains operational and is flagged by five security blocklists, including Phishunt, PhishingArmy, PhishDestroy, Hagezi, and BLP-Malware. VirusTotal reports that 18 of 95 security vendors detect this domain as malicious. Additional threat intelligence platforms, such as AlienVault OTX, have included it in 25 threat intelligence pulses, further corroborating its association with phishing activity. Infrastructure analysis reveals the use of Vue.js and Nginx, along with HSTS implementation, which may be employed to lend an appearance of legitimacy. The domain holds a Scamadviser trust score of 1/100 and a Gridinsoft trust score of 1/100, both indicating a high level of risk. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites. No specific phishing kit or additional technical artifacts have been confirmed at this time, and the exact content or functionality of the site remains unanalyzed. Defenders should treat binanceii.com as a high-risk domain. Network-level blocking is recommended, particularly for organizations handling cryptocurrency transactions or financial data. Users encountering this domain should avoid interaction, as it is likely designed to harvest credentials or facilitate fraudulent transactions. Further monitoring of associated infrastructure, such as the resolving IP and registration patterns, may help identify related threats.