binance-accountsecure[.]com

This domain, binance-accountsecure.com, is an active phishing site targeting the Binance brand. It was registered on August 15, 2025, through the registrar AFRIREGISTER S.A. and resolves to IP address 65.21.207.145, which is hosted on AS24940 (Hetzner Online GmbH) in Finland. The domain uses nameservers ns1.001.africa, ns2.001.africa, and ns3.001.africa. The page title is 'Domain Default page,' indicating the site may be a placeholder or under development, but the domain is flagged as a cryptocurrency scam by multiple security sources. The SSL certificate is issued by Let's Encrypt (R12), and the site returns an HTTP 200 status, confirming it is operational. The technologies detected include Plesk and Nginx, suggesting a shared hosting environment. Threat intelligence from AlienVault OTX shows this domain appears in one pulse, and VirusTotal reports 9 out of 95 security vendors flag it as malicious. Additionally, it is blocked by PhishDestroy and appears on one security blocklist. Trust assessments are extremely low, with Gridinsoft and Scamadviser scores of 0/100 and 1/100, respectively. The exact content of the phishing page has not been analyzed, but the domain name explicitly references Binance account security, strongly indicating an attempt to deceive users into revealing credentials or cryptocurrency assets. It is uncertain whether the site currently hosts a functional phishing kit or is preparing to deploy one. Defenders should monitor this domain for changes in content, block access at the network level, and report it to hosting provider Hetzner for takedown. Users should avoid visiting the domain and be cautious of unsolicited communications directing them to it. The infrastructure relies on African nameservers and a European IP, a combination that may complicate takedown efforts.