binanceweb3[.]help

On July 23, 2026, the domain binanceweb3.help was observed in an elevated‑risk brand‑impersonation case targeting Binance. The domain was registered on 2025-04-06 through Gname.com Pte. Ltd. and resolves to the IPv4 address 99.84.152.75, which belongs to AS16509 (Amazon.com, Inc.) located in Germany. DNS resolution is served by major.ns.cloudflare.com and nicole.ns.cloudflare.com, indicating use of Cloudflare’s DNS infrastructure. HTTP requests return a page whose title is "Binance - Cryptocurrency Exchange for Bitcoin, Ethereum & Altcoins", matching the official Binance branding, and the site presents a Google Trust Services (WE1) TLS certificate, suggesting a legitimate‑looking HTTPS endpoint. Automated analysis on VirusTotal recorded a single positive detection out of ninety‑five scanners, confirming that at least one security vendor identified malicious characteristics.

The domain appears on one external security blocklist and has been actively blocked by the PhishDestroy feed. A Gridinsoft trust score of 39 / 100 reflects a low reputation rating. Infrastructure fingerprints show the site is hosted on Amazon Web Services and delivered via Amazon CloudFront, a common pattern for phishing and crypto‑scam deployments. The listed scam type is "Crypto Scam", consistent with the brand impersonation of Binance.

The domain is currently offline, which limits real‑time verification of page content, but the existing indicators are sufficient for detection and mitigation. Defenders should add binanceweb3.help to URL filtering, DNS sink‑hole, and endpoint block lists, monitor for any resurgence of the domain or associated IP address, and scrutinize traffic to Amazon‑hosted services that reference Binance‑related keywords. Continuous observation of the registrar Gname.com and the Cloudflare name servers is recommended to catch future registrations that reuse the same infrastructure.