binance158[.]com

Analysis of binance158.com shows a newly registered domain (created 17 March 2025) that is actively serving web content (HTTP 200) and presents the page title “Binance 币安”, directly referencing the Binance brand. The site is hosted on IP 154.201.183.61, which resolves to a Hong Kong datacenter (AS132839 POWER LINE DATACENTER) and is served by Nginx with HSTS enabled. DNS is provided by a3.share-dns.com and b3.share-dns.net, and the certificate is a Let's Encrypt R13 issuance, indicating a legitimate TLS setup but not preventing abuse. Reputation metrics are extremely low: Gridinsoft assigns a trust score of 0/100, Scamadviser rates the domain 21/100, and the domain appears on a single security blocklist, currently listed by PhishDestroy.

VirusTotal records a single detection out of 95 scanning engines, confirming that at least one vendor has flagged the site as malicious. The registrar listed is InterNetX GmbH, a common registrar for many malicious domains. The site is classified as a “Crypto Scam” and explicitly impersonates Binance, matching the brand target information.

While the page content has not been inspected, the combination of brand impersonation, low trust scores, detection by security vendors, and hosting infrastructure suggests a high‑risk credential‑stealing or fund‑diversion operation. Defenders should block DNS resolution to 154.201.183.61, add binance158.com to web‑filter blocklists, monitor outbound traffic for connections to the identified nameservers, and enforce multi‑factor authentication for any Binance‑related accounts. Continuous monitoring of threat intel feeds for additional indicators of compromise related to this domain is recommended, as the current evidence points to an active high‑severity threat.