binanc-ewallet[.]com

The domain binanc-ewallet.com was observed on July 12, 2026 as an active brand‑impersonation site targeting Binance users. The site returns HTTP 200, hosts a page titled “binanc-ewallet.com”, and presents a TLS certificate issued by GoDaddy.com (GoDaddy TLS Intermediate CA DV – R1v1). The certificate chain is valid, but the domain’s use of a publicly trusted certificate masks malicious intent. Infrastructure analysis shows the domain resolves to 52.223.13.41, an address owned by Amazon.com, Inc. (AS16509) located in the United States. The host runs a stack comprising Node.js, Express, Nginx, OpenResty, and Apache Traffic Server, with HTTP Strict Transport Security (HSTS) enabled. Nameservers are ns1.renewyourname.net and ns2.renewyourname.net, both associated with the registrar TUCOWS.COM, CO. Threat intelligence indicates the site is currently listed on three security blocklists and has been blocked by multiple filtering solutions, including PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal reports two of ninety‑five scanners flagging the domain as malicious. The page mimics Binance branding, attempting to lure credential or wallet information from unsuspecting visitors. The combination of a high‑trust SSL certificate, a legitimate cloud provider backend, and the presence of HSTS suggests an effort to increase perceived legitimacy and reduce interception. Defenders should block binanc-ewallet.com at perimeter and DNS layers, monitor outbound connections to 52.223.13.41, and update web filtering policies to include the observed blocklist identifiers. Incident response teams should inspect logs for any user interaction with the domain, especially requests for Binance authentication or wallet addresses. Ongoing threat hunting should consider the associated nameservers and registrar for other domains that may share the same infrastructure, as the attacker appears to leverage commodity cloud services to host the campaign.