binance-download[.]at

This domain, binance-download.at, is flagged as a high-risk phishing site impersonating the Binance cryptocurrency brand. It was created on May 15, 2026, and remains active as of July 12, 2026. The domain resolves to IP 188.114.97.3, which is hosted by CloudFlare, Inc. in Canada (CA). The page title, decoded as 'Binance 2026 - Secure Web3 Wallet Registration and Cryptocurrency Trading Platform', is a clear attempt to deceive visitors into believing it is an official Binance service. The domain uses an SSL certificate from Google Trust Services (WE1), which is a legitimate certificate authority, but this does not indicate the site is safe; it only means the connection is encrypted. The HTTP status code 301 indicates a redirect, likely to another phishing page or a login harvesting form. The Gridinsoft trust score is 0 out of 100, confirming a high level of distrust. VirusTotal reports 16 out of 95 security vendors flagging this domain as malicious, and it appears on at least one security blocklist. AlienVault OTX shows the domain is included in one threat intelligence pulse, indicating it has been observed in the context of a phishing campaign. PhishDestroy has already blocked this domain. The primary uncertainty is the exact landing page content after the redirect and whether the phishing kit is hosted on the same server or elsewhere. Defenders should ensure that their email and web gateways block this domain and any subdomains. Users who have visited this site should be warned to change their Binance account credentials immediately and enable two-factor authentication. Monitoring for similar domains with the 'binance-download' pattern is recommended, as the threat actor may register additional variations. No other infrastructure details, such as the ASN or specific hosting provider beyond CloudFlare, are available in the current intelligence.