binanceo[.]com

The domain binanceo.com was registered on May 21, 2024 through Media Elite Holdings Limited and resolves to the IP address 3.171.38.13, which belongs to Amazon Web Services (AS16509) in the United States. The site is delivered via Amazon CloudFront and uses the public DNS service thednscloud.com (ns1.thednscloud.com, ns2.thednscloud.com). Infrastructure analysis reveals that the site presents a valid TLS certificate issued by Let’s Encrypt (R13) and returns an HTTP 302 redirect. The page title returned by the server is “Create a free account | Binance”, directly referencing the Binance brand. This aligns with the recorded threat classification of brand impersonation and the declared scam type of cryptocurrency. Threat intelligence sources show that binanceo.com is listed on one security blocklist and has been flagged by PhishDestroy. The Gridinsoft trust score is 0 out of 100, indicating a highly malicious reputation. VirusTotal reports a single detection out of 95 scanning engines, confirming at least one vendor has identified malicious behavior. While the available data confirms the domain’s intent to mimic Binance’s registration flow, no detailed content analysis or payload capture has been published. Consequently, the exact mechanism used to harvest credentials or deploy malicious code remains uncertain. Further forensic examination of the landing page and any subsequent redirects would be required to map the full attack chain. Defenders should block binanceo.com at the network perimeter and add the associated IP address to deny lists. Monitoring for outbound connections to the AWS edge location and for TLS certificates issued by Let’s Encrypt for this domain can provide early warning of re‑hosting attempts. Continuous threat‑feed updates are recommended to capture any new detections that may arise.