fq-binance[.]com

This domain is flagged as a high-risk brand impersonation threat specifically targeting Binance, a major cryptocurrency exchange platform. Analysis indicates the domain was designed to deceive users into believing they are accessing the legitimate Binance portal, potentially leading to unauthorized asset transfers or credential compromise. The threat type is classified as brand impersonation with no evidence of direct crypto drainer functionality, though secondary payloads cannot be ruled out. Infrastructure analysis reveals the domain resolved to IP address 98.143.159.230 and was registered through Spaceship, Inc. The SSL certificate was issued by Let's Encrypt (serial number prefix E8), a common tactic to lend false legitimacy. VirusTotal detection metrics show 20 out of 95 security vendors flagged the domain as malicious. The domain appears on three security blocklists and is actively blocked by multiple threat intelligence feeds, including PhishDestroy, MetaMask, and SEAL. The page title, "币安官网入口 - 官方安全通道 | Binance 全球加密交易平台 | 全球最值得信赖的数字资产交易平台," directly mimics Binance's official branding in both Chinese and English. Mitigation steps for this brand impersonation threat include immediate blacklisting of the domain and its associated IP (98.143.159.230) across all network security controls. Organizations should deploy indicators of compromise (IOCs) to endpoint detection systems and email security gateways to prevent user access. Users who may have interacted with the domain should be instructed to reset credentials via the legitimate Binance platform (binance.com) and enable multi-factor authentication. Security teams should monitor for unusual login attempts or transaction patterns originating from affected accounts. Given the domain's current offline status, continuous monitoring for re-registration or re-emergence under similar naming conventions is recommended.