domraf[.]ru

The domain domraf.ru is a confirmed phishing site engaged in brand impersonation targeting Binance users. It operates as a crypto scam, specifically promoting a fraudulent scheme titled 'Bitcoin Bank Breaker' rather than deploying a drainer kit. As of the latest verification, domraf.ru has been taken offline, though it previously posed an elevated risk to visitors by attempting to deceive them into disclosing sensitive information or transferring cryptocurrency under false pretenses.

Technical analysis of domraf.ru reveals limited detection by security vendors, with only 3 of 95 VirusTotal vendors flagging the domain, including ESET and SOCRadar. The domain appears on 1 security blocklist (PhishDestroy) but is not flagged by Google Safe Browsing. It resolves to the IP address 179.43.170.153, hosted under ASN 51852 (Private Layer INC, Switzerland), and is registered through the same IP range (179.43.170.128 - 179.43.170.159). No SSL certificate is present, and the nameservers are ns1.regery.net, ns2.regery.net, and ns3.regery.net. The Gridinsoft trust score for domraf.ru is 0/100, further confirming its malicious nature.

Individuals who interacted with domraf.ru should immediately revoke any token approvals granted to unknown contracts and consider transferring funds to a new wallet to mitigate potential losses. If credentials were entered on the site, users should change their Binance password and enable two-factor authentication (2FA) without delay. Monitor accounts for unauthorized transactions and report the incident to Binance support. The domain can also be reported to PhishDestroy or other threat-intelligence platforms to aid in broader security efforts.