binance-disconnect[.]com

This domain is an active credential harvesting site targeting Binance users. The page displays a fake 'Security Verification' interface designed to trick visitors into entering their account credentials, which are then captured by threat actors. The site specifically mimics Binance's authentication process, increasing the likelihood of successful compromise for users who believe they are interacting with legitimate Binance security measures. Analysis indicates the domain was registered on October 27, 2025, through CNOBIN INFORMATION TECHNOLOGY LIMITED and currently resolves to the IP address 188.114.96.3, hosted on Cloudflare infrastructure (AS13335). Security vendors on VirusTotal have flagged this domain as malicious, with 11 out of 95 engines detecting it as a phishing threat. The absence of an SSL certificate further confirms its illegitimate nature, as legitimate financial services universally employ encryption for user protection. If you visited binance-disconnect.com and entered any credentials, immediately change your Binance password and enable multi-factor authentication if not already active. Review your account for unauthorized transactions or changes, and consider revoking access to any linked applications or devices. Report the incident to Binance's official security team and monitor your account for suspicious activity. Do not interact with any links or communications claiming to be from Binance that you did not explicitly request.