binance-qw[.]com[.]cn

Analysis of the domain binance-qw.com.cn indicates it is an active phishing site impersonating the Binance cryptocurrency exchange platform. As of July 26, 2026, the domain remains operational, returning an HTTP 200 status code, which suggests a live and accessible web resource. It appears on one security blocklist, and four out of ninety-one security vendors on VirusTotal have flagged the domain as malicious, aligning with its classification as a high-risk phishing threat. The domain's infrastructure has not been fully mapped in public threat feeds beyond its presence on PhishDestroy's blocklist.

No additional contextual data—such as registrar details, hosting provider, autonomous system number, or SSL certificate attributes—has been provided in available intelligence. The exact content of the site remains unanalyzed; however, the domain name structure (binance-qw) strongly suggests an intent to deceive users into believing it is an official Binance portal, likely targeting login credentials or sensitive financial information. Defenders are advised to treat this domain as hostile and implement immediate blocking at the DNS, proxy, and endpoint levels.

Security teams should monitor for connections to binance-qw.com.cn in network logs, particularly from endpoints that handle cryptocurrency transactions or store credentials related to financial services. If internal access is detected, initiate incident response procedures to contain potential credential theft or unauthorized fund transfers. Given the domain's active status and limited detection coverage, proactive hunting for related indicators—such as subdomains, associated IPs, or SSL fingerprints—is recommended to uncover additional infrastructure linked to this campaign.