webp[.]co[.]com

This domain, webp.co.com, is a confirmed phishing infrastructure designed to impersonate Binance, a major cryptocurrency exchange platform. The site targets users by mimicking legitimate Binance login portals, aiming to harvest sensitive credentials such as usernames, passwords, and two-factor authentication codes. Given the high-value nature of cryptocurrency accounts, successful compromise could lead to immediate financial theft, unauthorized transactions, or further exploitation of linked accounts. The domain was operational under the guise of a site under construction, a common tactic to delay detection while preparing malicious payloads or redirect chains. Analysis of webp.co.com reveals multiple technical indicators of malicious intent. The domain is flagged by 15 out of 95 security vendors on VirusTotal, indicating widespread detection as a phishing threat. It appears on three independent security blocklists and is actively blocked by cryptocurrency wallet protection mechanisms. The domain was registered through Moniker Online Services LLC, a registrar frequently associated with high-risk domains due to its lenient registration policies. Infrastructure analysis shows the domain resolves to the IP address 107.189.22.184, a host previously linked to other phishing campaigns targeting financial services. The page title, 'Site is being set up...,' suggests the domain was in an intermediate stage of deployment, likely awaiting final malicious content or redirect logic. Users who visited webp.co.com or interacted with any content hosted on this domain should take immediate action to mitigate potential compromise. First, terminate any active sessions on cryptocurrency platforms and revoke access to any connected applications or browser extensions. Reset passwords for Binance and any other financial accounts, ensuring the use of strong, unique credentials. Enable multi-factor authentication if not already active, preferably using hardware-based tokens rather than SMS or app-based codes. Monitor account activity for unauthorized transactions and report any suspicious behavior to the platform's security team. Additionally, scan local devices for malware, as phishing sites may deploy malicious scripts or payloads to maintain persistence. If credentials were entered, assume they are compromised and avoid reusing them across any other services.