ukraine[.]binance[.]zaidev[.]ch

PhishDestroy identifies ukraine.binance.zaidev.ch as an active brand-impersonation domain designed to steal Binance credentials. The site mirrors Binance’s login interface and prompts victims to enter their email and password under the guise of “Ukraine war relief” donations. Once harvested, these credentials are used to drain wallets or sold on dark-web markets. This domain resolves to IP address 49.13.208.211 and is served over a Let’s Encrypt SSL certificate, giving it a false appearance of legitimacy.

This domain was flagged by PhishDestroy using seed d278e8. Independent analysis shows 1 out of 95 VirusTotal engines currently detect the page as malicious, highlighting how quickly brand-impersonation scams can fly under the radar. Infrastructure data reveals registration on a bullet-proof registrar tailored for short-lived malicious campaigns. The page was spun up to exploit current events and lure crypto holders into surrendering sensitive account details. Without endpoint detection catching the subtle mismatches in page branding or domain spelling, users are one click away from compromise.

If you visited ukraine.binance.zaidev.ch, assume your Binance credentials may have been exposed. Immediately log in to Binance and enable two-factor authentication; if you reused the password elsewhere, change it everywhere. Revoke any API keys created during the visit and open a support ticket with Binance to report the incident. Run a malware scan on the device you used to access the page and monitor wallet transactions for unauthorized withdrawals. Report the domain to your local cybercrime unit and share IOCs (49.13.208.211, Let’s Encrypt certificate) with threat-intel platforms to help block the campaign globally.