binancepromotion[.]com

PhishDestroy identifies binancepromotion.com as a brand impersonation phishing domain targeting Binance. The domain was created on April 02, 2026, and registered through TuringSign Inc. d/b/a Cosmotown. It features a page title of yl34511线路中心(中国)有限公司, indicating a non-English audience. No specific drainer kit was identified, but the domain's design likely mimics Binance's login or promotional pages to harvest credentials.

Technical indicators reveal that VirusTotal flags this domain with a score of 10 out of 95 security vendors, and it appears on 1 security blocklist. AlienVault OTX includes it in 9 threat intelligence pulses, suggesting active monitoring by the security community. The domain resolves to IP address 140.188.33.9 and uses an SSL certificate issued by Let's Encrypt with fingerprint E8. Google Safe Browsing status was not explicitly provided but the domain is now offline.

As of the latest check, binancepromotion.com has been taken offline. PhishDestroy recommends that users who may have interacted with this domain monitor their Binance accounts for unauthorized access and enable two-factor authentication. No further immediate risk remains, but similar domains may appear. Users should always verify URLs before entering credentials.