realfinance[.]web[.]app

The domain realfinance.web.app was created on February 21, 2026 and is currently hosted on Google’s infrastructure, resolving to IP address 199.36.158.100 which maps to a US‑based Google data center. The site is served over TLS using a Google Trust Services certificate (WR4) and employs modern transport features such as HTTP/3 and HSTS. Detected front‑end components include Webflow, Firebase hosting, and the jsDelivr CDN. The page title reads “Real Finance | RWA Tokenization Infrastructure for Web3,” and the site is classified as a crypto‑related scam that impersonates the Binance brand. The domain appears on two independent blocklists (PhishDestroy and ScamSniffer) and received a Gridinsoft trust score of 0 / 100, indicating a high likelihood of malicious intent. VirusTotal analysis shows a single vendor flagging the domain, reinforcing the suspicion. While the exact content of the landing page has not been examined, the combination of brand impersonation, recent registration, use of reputable hosting services to mask malicious activity, and placement on multiple blocklists suggests a coordinated attempt to deceive users seeking Binance services. Defenders should block the domain at network and endpoint layers, monitor for related traffic to the IP address, and update detection rules to include the observed technology stack and TLS fingerprint. Further investigation of the site’s payload and any associated redirects is recommended to determine the full scope of the campaign.