binanatse[.]com

This domain is flagged as a credential harvesting site designed to impersonate the Binance cryptocurrency exchange platform. Analysis indicates the domain was used to host fraudulent login pages, tricking users into entering their account credentials, which are then captured by threat actors for unauthorized access or financial theft. The infrastructure was likely leveraged in targeted phishing campaigns against cryptocurrency users, a common tactic in financial fraud operations. Infrastructure analysis reveals the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 62.60.226.89 and is currently offline. It appears on one security blocklist and is flagged by 6 out of 95 security vendors on VirusTotal, indicating moderate detection but persistent risk. Additionally, the domain is referenced in one threat intelligence pulse on AlienVault OTX, further confirming its malicious classification. Users who visited binanatse.com or entered credentials on any page hosted under this domain should immediately revoke access to their Binance account and enable multi-factor authentication. Monitor linked accounts for unauthorized transactions and report any suspicious activity to the legitimate platform. Reset passwords for any accounts where the same credentials may have been reused. Organizations should update internal blocklists to include this domain and its associated IP address to prevent future access attempts.