robindex[.]xyz

Analysis of robindex.xyz, observed as a wallet/seed phishing site targeting Binance users, indicates that the domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited. DNS resolution points to 172.67.162.53, an address owned by AS13335 Cloudflare, Inc., located in the United States. The site served content over HTTPS without a valid SSL certificate, yet Cloudflare‑provided HSTS and HTTP/3 were detectable, confirming that traffic was proxied through Cloudflare’s edge network. The page title returned by the server reads “Robindex | Governance Portal,” which does not directly disclose the malicious intent but aligns with the reported impersonation of Binance’s governance interface. VirusTotal recorded six positive detections out of ninety‑five scanners, and the domain currently appears on three external blocklists, including PhishDestroy, MetaMask, and SEAL.

Gridinsoft assigned a trust score of 0 / 100, reinforcing the malicious classification. The domain’s nameservers are eva.ns.cloudflare.com and ignat.ns.cloudflare.com, both typical of Cloudflare‑hosted services. Uncertainty remains regarding the exact payload delivered to victims, as the site’s HTML content has not been captured in this dataset. No SSL certificate was presented, limiting the ability to verify certificate transparency logs or pinpoint additional infrastructure.

The offline status reported on 25 July 2026 suggests that the site may have been taken down, but the underlying hosting arrangement on Cloudflare could allow rapid re‑deployment. Defenders should continue to block robindex.xyz at perimeter and endpoint layers, update URL filtering rules with the listed blocklists, and monitor for re‑appearance of the same IP address or associated Cloudflare nameservers. Threat‑intel feeds should be enriched with the registrar and creation date to flag future domains sharing the NiceNIC International Group registration pattern.