eth-defi22[.]com

Analysis of eth-defi22.com, created on February 21, 2026 and currently taken offline, shows multiple indicators of malicious activity targeting Binance users. The domain resolves to 172.67.216.130, an address owned by Cloudflare (AS13335) located in the United States, and is served from Cloudflare's generic nameservers adam.ns.cloudflare.com and chan.ns.cloudflare.com. No TLS certificate is presented, which is atypical for a legitimate financial service and further weakens the domain's credibility. The page title observed during the brief scan was "USDT," a token commonly associated with Binance, aligning with the reported impersonation of the Binance brand. The scam type is identified as wallet/seed phishing, suggesting that the site was intended to harvest private keys or recovery phrases from unsuspecting victims.

Reputation services reflect low confidence: Scamadviser assigns a trust score of 35 out of 100, while Gridinsoft reports a score of 0 out of 100. VirusTotal analysis flags the domain in 12 of 93 security vendor engines, and the domain appears on at least one external blocklist. PhishDestroy has already added eth-defi22.com to its blocklist, confirming active mitigation by at least one anti‑phishing organization. The registrar listed is Gname.com Pte. Ltd., a provider frequently used for rapid domain registration.

While the site is presently offline, the combination of brand impersonation, lack of SSL, low trust scores, and multiple vendor detections indicates a high likelihood of malicious intent. Defenders should continue to block the domain at network perimeters, monitor DNS queries for the associated IP address, and update endpoint protection signatures to include the observed indicators. Organizations that rely on Binance services should educate users about the absence of TLS and the presence of unrelated page titles such as "USDT" when accessing unofficial domains, and enforce multi‑factor authentication to mitigate credential theft.