binanceminingcoin[.]com

Analysis of binanceminingcoin.com shows a confirmed brand‑impersonation campaign targeting Binance users. The domain was registered on January 23, 2025 through Tucows Domains Inc. and is currently offline. DNS resolution points to IP 66.23.233.12, hosted in the United States and assigned to AS19318 Interserver, Inc. The authoritative nameservers are vda4100a.trouble-free.net and vda4100b.trouble-free.net. Web server fingerprints reveal Nginx with the OpenResty module, but no SSL certificate is presented, indicating the site operated over plain HTTP.

The page title returned by the server is "bitcypo," which does not correspond to legitimate Binance branding and further supports the malicious intent. Threat intelligence sources list the site as a crypto‑scam; it impersonates Binance and was flagged by one AlienVault OTX pulse. VirusTotal recorded a single positive detection out of 95 scanned scanners, and Gridinsoft assigned a trust score of 0 / 100, reflecting extreme risk. The domain appears on one security blocklist and has been blocked by PhishDestroy.

While the site is no longer reachable, the infrastructure details—IP address, hosting provider, and lack of TLS—remain useful for network defenders. Organizations should continue to block the IP and the domain at perimeter defenses, monitor for similar patterns in DNS queries, and update URL filtering rules to include the observed page title and host header. Because the site is offline, no further payload analysis is available, and the exact phishing kit or page content remains unknown. Continuous observation of related Binance‑impersonation campaigns is recommended to detect any re‑use of the same hosting assets or similar domain naming schemes.