sr-crude[.]vip

Analysis of sr-crude.vip indicates a newly registered domain used for brand impersonation targeting Binance. The domain was created on 2 December 2025 and is currently listed as offline, suggesting that the malicious site is no longer reachable. DNS resolution points to the Cloudflare network (AS13335) with the address 104.21.57.216, and the authoritative nameservers are kanye.ns.cloudflare.com and sarah.ns.cloudflare.com, both belonging to Cloudflare’s public DNS service. The registrar is Dominet (HK) Limited, a provider frequently observed in malicious registrations. No TLS certificate is presented, meaning the site would have been served over plain HTTP if accessed.

Threat intelligence shows that 15 of 93 security vendors on VirusTotal flagged the domain, and it appears on two independent blocklists. Additional detections include listings by PhishDestroy and ScamSniffer. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious classification. The page title returned by HTTP requests is “SR‑Crude”, which does not reference Binance or any legitimate Binance branding, confirming that the site does not present authentic content. The only explicit brand reference in the intelligence is the “impersonates: binance” label, indicating that the domain was intended to lure Binance users, although the exact phishing landing page has not been captured.

Given the observed infrastructure, defenders should add 104.21.57.216 and the domain sr-crude.vip to network‑level deny lists, enforce DNS sink‑holing for the associated Cloudflare nameservers, and monitor for any future re‑registration of the same second‑level name. Because the site is offline, active takedown is not applicable, but continuous observation of the registrar and hosting provider is recommended to detect potential reuse. Organizations that rely on Binance services should educate users about unsolicited communications that reference unrelated domains such as sr-crude.