binayex[.]com

The domain binayex.com was taken offline as of the report date, but historical data indicates it operated a cryptocurrency exchange façade that impersonated Ethereum. The site was registered on September 12 2025 through Web Commerce Communications Limited and was hosted on Cloudflare’s network (AS13335) resolving to IP 104.21.28.93, an address located in the United States. DNS resolution used the Cloudflare authoritative nameservers diva.ns.cloudflare.com and vick.ns.cloudflare.com. No TLS certificate was observed, meaning the service was delivered without HTTPS protection. Reputation services assigned the lowest possible scores: Scamadviser and Gridinsoft each rated the domain 1 out of 100.

VirusTotal scanned the domain and two of the ninety‑five AV engines flagged it as malicious, confirming the presence of at least one detection. The domain appears on a single security blocklist and is listed as blocked by PhishDestroy. AlienVault OTX recorded the domain in one threat‑intel pulse, linking it to broader crypto‑scam activity. The page title retrieved from the live capture read "Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | BINAYEX," which aligns with the declared scam type of a crypto scam and the brand impersonation of Ethereum.

No additional page content, login forms, or credential‑harvesting mechanisms have been publicly disclosed, so the exact malicious payload remains unverified. Given the combination of low trust scores, partial VirusTotal detections, presence on blocklists, and explicit brand impersonation, defenders should continue to block binayex.com at network perimeters and DNS resolvers. Security teams should update intrusion‑detection signatures to flag HTTP requests to this host and monitor for any future re‑registration attempts. Analysts should also watch for reuse of the underlying Cloudflare IP range in other crypto‑related campaigns, as the infrastructure may be repurposed for similar impersonation attacks.