binance-crypto[.]cx

The domain binance-crypto.cx was registered on February 21, 2026 through CentralNic Ltd and is configured with Cloudflare nameservers kevin.ns.cloudflare.com and amy.ns.cloudflare.com. DNS resolution points to IP address 172.67.221.121, which belongs to Cloudflare’s AS13335 network and is geolocated to the United States. The site presented a Google Trust Services SSL certificate issued under the WE1 hierarchy, indicating a valid TLS termination despite the malicious intent.

Automated scans report HTTP/3 support and the presence of Cloudflare infrastructure, consistent with a typical fast‑flux or CDN‑based hosting pattern used for abuse. VirusTotal analysis recorded 15 detections out of 93 scanned security vendors, and the domain appears on a single external blocklist. PhishDestroy has already taken the domain offline, and its current HTTP response is a generic "404 Not Found" page title, suggesting that the original content—presumably a crypto‑related impersonation of the Binance brand—has been removed or never hosted.

The intelligence flags the domain as a crypto scam that impersonates Binance, but no further page content, login forms, or malicious payloads have been observed. Uncertainty remains regarding the specific lure or credential‑harvesting mechanisms that may have been deployed before takedown. Defenders should continue to block the domain and its underlying IP, monitor for additional registrations using similar naming patterns, and incorporate the observed indicators (creation date, Cloudflare nameservers, SSL issuer, and VirusTotal detection count) into threat‑intel feeds to improve early detection of related infrastructure.