bynoz[.]com

Analysis as of July 24, 2026 indicates that the domain bynoz.com is presently offline but exhibits multiple indicators of a cryptocurrency‑focused impersonation campaign. The domain was registered on June 02, 2025 through NiceNIC International Group Co., Limited and resolves to the Cloudflare address 172.67.149.207, which is associated with AS13335 in the United States. No TLS certificate is observed, meaning the site did not serve HTTPS traffic. The page title retrieved during the brief live period reads “Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | Bynoz”, and the listed brand target is Ethereum, matching the classification of a crypto scam.

VirusTotal scans returned three positive detections out of ninety‑five vendors, and the domain appears on a single security blocklist, specifically PhishDestroy. Independent reputation services assign a trust score of 1 out of 100 on both Scamadviser and Gridinsoft, reinforcing the malicious assessment. The combination of brand impersonation, low reputation scores, and detection by multiple vendors suggests a high likelihood of fraudulent activity aimed at extracting cryptocurrency from unsuspecting users. Uncertainties remain regarding the specific phishing kit or payload used, as no further forensic artefacts have been disclosed.

Defenders should continue to block the domain at perimeter and DNS filters, monitor the associated IP address for any future re‑use, and consider adding the IP to threat‑intel feeds. Additional scrutiny of related Cloudflare‑hosted domains that share the same nameserver configuration may reveal broader campaign infrastructure. Ongoing observation is recommended until the domain is definitively retired.