godprox[.]cc

This domain is flagged as an elevated-risk brand impersonation site specifically targeting Binance users. Analysis indicates the threat involves credential theft and potential cryptocurrency wallet compromise, leveraging deceptive Bitcoin mining-themed pages to lure victims. The infrastructure mimics legitimate exchange interfaces to harvest login credentials, API keys, or seed phrases, which are commonly exploited for unauthorized fund transfers or account takeovers. Infrastructure analysis reveals the domain godprox.cc was registered on March 07, 2025, through NiceNIC International Group Co., Limited. It resolves to the IP address 147.45.198.141, hosted under AS212701 (Hostinux Limited) in Germany. The SSL certificate is issued by Let's Encrypt (serial number E7), a common choice for both legitimate and malicious sites. Detection metrics show 18 out of 95 security vendors on VirusTotal flagged the domain as malicious. The domain appears on two security blocklists and is actively blocked by PhishDestroy and PhishingDB. The page title 'Bitcoin Mining' further corroborates the intent to deceive users into engaging with fraudulent cryptocurrency-related content. Mitigation against this brand impersonation threat requires multi-layered defenses. Users should verify domain authenticity by cross-referencing official Binance communication channels and avoiding links from unsolicited messages. Organizations should implement DNS filtering to block known malicious domains, including godprox.cc, and enforce strict validation of SSL certificates for financial platforms. Security teams are advised to monitor for indicators of compromise, such as connections to 147.45.198.141 or domains registered via NiceNIC, and deploy endpoint protection capable of detecting credential theft attempts. Given the domain's recent creation and offline status, continuous monitoring for re-registration or similar infrastructure is recommended.