binance[.]consumerhelpline[.]net

Analysis of binance.consumerhelpline.net shows a newly registered domain created on 11 March 2026 through Ultahost, Inc. The domain resolves to the IPv4 address 82.25.34.79, which belongs to AS212238 Datacamp Limited and is geolocated in Norway. The hosting infrastructure is served by Apache HTTP Server and uses the authoritative nameservers ns1.ultahost.com through ns4.ultahost.com. The site’s HTTP response previously presented the page title “Binance Customer Support”, directly referencing the Binance brand, and the overall classification is a crypto‑scam that relies on brand impersonation. VirusTotal scans reported five detections out of ninety‑four security vendors, indicating that multiple AV engines identified the domain as malicious.

The domain is listed on one external security blocklist and has been actively blocked by the PhishDestroy mitigation service. The current operational status is offline, suggesting that the phishing infrastructure has been taken down or is no longer serving content. Evidence confirms the use of the Binance brand without authorization, satisfying the definition of brand impersonation. The short lifespan of the domain, combined with the modest detection count, may indicate a low‑volume campaign targeting Binance users.

Uncertainties remain regarding the presence of SSL/TLS certificates, the exact payload delivered to victims, and whether additional supporting infrastructure exists elsewhere. Defenders should continue to monitor the IP address 82.25.34.79 for any re‑use, enforce blocking of the domain and its associated IP in network perimeter defenses, and add the domain to internal phishing and malware blocklists. Organizations using Binance services should alert users to the existence of this impersonating site and advise verification of URLs before entering credentials. Ongoing vigilance through threat‑intel feeds and periodic re‑scanning of the domain, should it become active again, is recommended.