Analysis of the domain binance-offer.netlify.app, observed on 2026-07-29, indicates that it is an active phishing infrastructure targeting users of the Binance platform. The domain is hosted on Netlify’s platform, as indicated by the registrar information. DNS resolution returns the IPv4 address 63.176.8.218; the authoritative nameserver lookup failed, returning NS_NOT_FOUND, which suggests the domain relies on Netlify’s default DNS configuration rather than custom nameservers. VirusTotal has recorded detections from 7 out of 91 scanned security vendors, demonstrating that multiple independent scanners have identified malicious behavior. The domain appears on a single external blocklist and is currently listed as blocked by the PhishDestroy feed, confirming that at least one community‑managed mitigation service recognises it as hostile. No additional public reputation signals, such as Safe Browsing verdicts, OTX tags, SSL certificate details, or HTTP response codes, are available in the supplied intelligence.
The presence of multiple vendor detections, combined with blocklist inclusion, justifies a high risk rating. Uncertainty remains regarding the exact phishing tactics employed because page‑title information, TLS parameters, and content analysis have not been disclosed. Consequently, the specific lure or credential‑harvesting mechanism cannot be described beyond the generic classification.
Defenders should treat the domain as hostile and enforce network‑level blocking of both the hostname and its resolved IP address 63.176.8.218. URL filtering solutions, DNS sinkholing, and endpoint allow‑list adjustments are recommended. Users should be warned against any unsolicited communications that reference Binance and direct them to this URL. Continuous re‑evaluation is advised as further telemetry becomes available, particularly any observations of page content, HTTP status, or additional blocklist listings, to refine detection and response actions.
Frankfurt am Main, DE
moonshot-listing-3k8.netlify.app 
