bin-ance[.]me

This domain, bin-ance.me, is flagged as a phishing site impersonating the cryptocurrency exchange Binance. Registered on February 21, 2026, through TLD Registrar Solutions Ltd., the domain resolves to IP address 193.24.123.182, hosted in Russia on AS200593 PROSPERO OOO. Infrastructure analysis reveals the use of Cloudflare for content delivery and HTTP/3 protocol, with nameservers pointing to amy.ns.cloudflare.com and kevin.ns.cloudflare.com. The SSL certificate is issued by Google Trust Services under WE1, consistent with typical Cloudflare-proxied setups. Despite the page title returning a 404 Not Found error, the domain remains active, indicating potential redirection or behind-the-scenes malicious operations.

Analysis of available threat intelligence shows the domain is categorized as a cryptocurrency scam, with an HTTP status of 302, suggesting users are likely redirected to a fraudulent login or credential harvesting page. The domain appears on three security blocklists and is blocked by PhishDestroy, MetaMask, and SEAL, reflecting widespread recognition of its malicious intent. VirusTotal analysis indicates 7 out of 95 security vendors flag this domain as malicious, confirming its risk posture. The brand target is clearly Binance, as the domain name uses a common typosquatting technique with a hyphen and misspelling.

Uncertainties remain regarding the exact payload or landing page content, as the current page returns a 404 error. This could mean the phishing kit is inactive, rotated, or only served under specific conditions such as user agent or geolocation filters. Defenders should monitor the domain for changes in page content or redirection behaviors and verify if other related infrastructure, such as additional subdomains or IP addresses, is linked to this campaign. Organizations and users are advised to block access to bin-ance.me at the network level and report the domain to relevant threat intelligence platforms for further analysis.