binance-airdrop[.]xyz

This domain, binance-airdrop.xyz, is a confirmed phishing site designed to impersonate Binance and deploy crypto drainer malware. Analysis indicates the site targets cryptocurrency users by presenting fraudulent airdrop offers, tricking victims into connecting wallets or entering sensitive credentials. The threat actor likely exploits the Binance brand to lend legitimacy, while the underlying infrastructure executes unauthorized transactions to drain funds from compromised wallets. The domain's design and functionality align with known crypto drainer campaigns, which often use social engineering to bypass security measures and initiate malicious smart contract interactions. Evidence supporting this assessment includes multiple technical indicators. The domain is flagged by 17 out of 95 security vendors on VirusTotal, with Google Safe Browsing specifically labeling it as SOCIAL_ENGINEERING. Registered through NicNames, Inc on February 21, 2026, the domain resolves to the IP address 159.203.143.218 and is secured with a Let's Encrypt SSL certificate. It appears on four security blocklists and is actively blocked by multiple security tools, including MetaMask and PhishDestroy. The page title, 'The domain binance-airdrop.xyz is powered by NicNames.com,' further confirms its association with the registrar's default parking page, though the domain is operational and serving malicious content. Users who have visited binance-airdrop.xyz or interacted with its content should take immediate action to mitigate risk. Disconnect any wallets linked to the site and revoke permissions for suspicious smart contracts using a blockchain explorer. Scan the device for malware, as crypto drainers may install additional payloads. Monitor wallet activity for unauthorized transactions and consider transferring funds to a new wallet if compromise is suspected. Report the domain to relevant security platforms and avoid engaging with any communications or offers originating from it. Given the high-risk nature of this threat, users should also enable multi-factor authentication on all cryptocurrency-related accounts and verify domain authenticity before interacting with any airdrop or promotional offers.