binances[.]club

The domain binances.club is currently active and has been classified as a high‑risk brand‑impersonation campaign targeting users of the Binance cryptocurrency exchange. Registration data show the domain was created on 18 April 2021 through the registrar Key‑Systems LLC and is served by the Russian name servers ns1.hosting.reg.ru and ns2.hosting.reg.ru. DNS resolution points to the address 185.129.100.112, which belongs to AS57724 DDoS‑Guard Ltd and is geolocated in Russia. The site presents a valid HTTPS certificate issued by Let’s Encrypt (certificate version R13), and the web server returns HTTP 200 responses, indicating the site is reachable and actively serving content.

Public reputation services assign extremely low trust scores: Scamadviser reports an 11 / 100 rating, while Gridinsoft records a 0 / 100 score. Two of the ninety‑five VirusTotal scanners have flagged the domain as malicious, and the domain appears on at least two blocklists, specifically PhishDestroy and Enkrypt. The page title returned by the server is “Binances Club | International Crypto Investors Club”, and the front‑end stack includes Tilda, YouTube embeds, Yandex.Metrika analytics, jQuery, and DDoS‑Guard protection components. The intelligence indicates the campaign is a crypto‑scam that leverages the Binance brand to lure victims, but the exact malicious payload or credential‑harvesting mechanism has not been disclosed in the available data.

Because the hosting provider is a DDoS‑mitigation service, attribution of the underlying operator remains ambiguous. Defenders should block network traffic to 185.129.100.112 and add binances.club to URL filtering policies. Continuous monitoring of the domain’s reputation scores and blocklist entries is advised, as the infrastructure may shift to additional IP addresses or hosting services.