bingwucoins[.]xyz

Analysis of bingwucoins.xyz, taken offline as of the report date, shows a high‑confidence indication of a wallet‑seed phishing operation targeting Binance users. The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare‑owned address 172.67.181.220, ASN 13335, located in the United States. The site presents a TLS certificate issued by Google Trust Services under the WE1 label, and the HTTP stack reports HSTS enforcement, Cloudflare routing, and HTTP/3 support, consistent with a professionally hosted phishing infrastructure. Page metadata reveals the title "Bing Wu 丙午 - Year of the Fire Horse," which bears no direct relation to the Binance brand, suggesting the page content was likely crafted to lure victims rather than provide legitimate information.

Security telemetry indicates the domain appears on one blocklist and has been flagged by PhishDestroy. Gridinsoft assigns a trust score of 0 / 100, and VirusTotal records four detections out of ninety‑five scanned engines, reinforcing the malicious classification. The declared scam type is Wallet/Seed Phishing, and the domain is explicitly noted to impersonate Binance, confirming its intent to harvest cryptocurrency credentials.

Defenders should immediately add bingwucoins.xyz to domain blocklists, deny traffic to its IP prefix, and monitor Cloudflare‑associated infrastructure for derivative domains. Continuous observation of the registrar NiceNIC and the employed nameservers (mustafa.ns.cloudflare.com, serenity.ns.cloudflare.com) is advised, as the same naming pattern may be reused in future campaigns. Given the offline status, threat actors may re‑activate the domain or clone the infrastructure; proactive filtering and threat‑intel sharing will mitigate potential re‑emergence.