fundstakedn[.]info

The domain fundstakedn.info has been identified as a brand impersonation threat specifically targeting Binance, a major cryptocurrency exchange platform. Analysis confirms this domain was designed to deceive users by mimicking Binance’s official branding, likely to facilitate unauthorized transactions or credential harvesting. The domain is currently offline, but prior activity warrants further scrutiny due to its elevated risk classification. Infrastructure analysis reveals that fundstakedn.info resolved to the IP address 188.114.96.3, hosted under Cloudflare, Inc. (AS13335) in the United States. The domain was registered through Cloudflare’s registrar services, a common tactic to obscure ownership and evade takedowns. At the time of assessment, 9 of 95 security vendors on VirusTotal flagged the domain as malicious, indicating a high confidence in its fraudulent nature. The SSL certificate was issued by Let’s Encrypt (R13), a legitimate provider often exploited by threat actors to lend false credibility. The domain appeared on one security blocklist and was blocked by at least one anti-phishing system. The page title, 'Home,' further suggests an attempt to replicate a legitimate login or dashboard interface. Current status indicates the domain has been taken offline, reducing immediate risk to users. However, the infrastructure and tactics observed align with known patterns of cryptocurrency-related fraud, including potential crypto drainer schemes. Organizations and individuals are advised to proactively block the domain and its associated IP (188.114.96.3) at the network level. Users should verify the authenticity of any Binance-related communications or websites by cross-referencing official channels. Security teams are recommended to monitor for residual activity, such as redirects or cached versions of the site, and update detection rules to include this domain’s indicators of compromise.