other · KY
Binance
Binance Holdings Ltd.
Cryptocurrency exchange (binance.com; Binance.US is a separate operator).
- Primary official domain
- binance.com
- Reviewed official domains
- 1 (directory review; organization has not verified)
- Directory source
- DomainSpoof directory · Suggest a correction
Matching domains, 30 days
231
registrable domains containing the brand; source date or last feed observation
First source-reported, 30 days
1
domains first source-reported within 30 days
First observed, 30 days
240
domains first observed by DomainSpoof in feeds
Email policy (primary domain)
DMARC quarantine
SPF -all · 2/10 lookups · Mail: Receives mail (5 MX hosts) · checked 2026-10-19 · published policy
What we watch for
Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.
- Brand tokens
- binance
- Label aliases
- Binance
- Official domains
- binance.com (all)
- Generated spellings
- 106 tracked · 76 observed somewhere · 30 not observed (all)
- Can receive mail
- 10 spellings and 20 reported domains publish MX records · mail at Above.com parking (parking placeholder) 5 · Google 4 · GoDaddy 3 · 15 more (76 spellings and 231 reported domains of the last 30 days checked; MX shows the domain can receive mail, not who operates it)
Matching domains with source reports or listings
Source claims are shown separately from our company matches. Default scope: brand in hostname. Choose “All associations” to include source-labelled matches on other sites.
| Domain / hostname | Source claim | Company match (DomainSpoof) | Date (mixed basis) | Latest DNS | Sources / records | Finding details |
|---|---|---|---|---|---|---|
endpoint[.]binancepay[.]dot2[.]wsMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive54.157.51.63Amazon Web ServicesAmazon Web Services (AS14618) · USec2-54-157-51-63.compute-1.amazonaws.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
binancemanagementcooperation[.]com[.]empressluxuryestate[.]com2 hostnames under empressluxuryestate.comMail: MXSPF · checked 2026-10-19mail at Above.com parking (parking placeholder) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive103.224.182.249Trellian (Above.com parking)Trellian (Above.com parking) (AS133618) · AUlb-182-249.above.comchecked 2026-10-19 10:50 UTC | 1 source · 1 record | Details |
www[.]binancemanagementcooperation[.]com[.]empressluxuryestate[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive103.224.182.249Trellian (Above.com parking)Trellian (Above.com parking) (AS133618) · AUlb-182-249.above.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
f-binance[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.129.17.105 · Confirmed phishing host address (DomainSpoof, 14 days)ColoCrossingColoCrossing (AS36352) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
fakebinance[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.21.49.90CloudflareCloudflare (AS13335) · US172.67.189.112CloudflareCloudflare (AS13335) · US2606:4700:3035::6815:315aCloudflareCloudflare (AS13335) · US2606:4700:3037::ac43:bd70CloudflareCloudflare (AS13335) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
fq-binance[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive98.143.159.230 · Confirmed phishing host address (DomainSpoof, 14 days)ColoCrossingColoCrossing (AS36352) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
guan-binance[.]com[.]cnMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive156.254.7.181 · Confirmed phishing host address (DomainSpoof, 14 days)CLOUDIE-AS-AP Cloudie Limited (AS55933) · HKchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
h5-binance[.]com[.]cnMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.21.70.20CloudflareCloudflare (AS13335) · US172.67.217.239CloudflareCloudflare (AS13335) · US2606:4700:3030::ac43:d9efCloudflareCloudflare (AS13335) · US2606:4700:3036::6815:4614CloudflareCloudflare (AS13335) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
finance-binance[.]org[.]hedgefunds-investment[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive185.53.179.128TEAMINTERNET-CA-AS (AS206834) · DEchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
home-binance[.]com2 hostnames under home-binance.comMail: DMARC · checked 2026-10-19DMARC policy quarantine | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive101.32.10.247 · Confirmed phishing host address (DomainSpoof, 14 days)Tencent CloudTencent Cloud (AS132203) · CNchecked 2026-10-19 11:00 UTC | 1 source · 1 record | Details |
www[.]home-binance[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive101.32.10.247 · Confirmed phishing host address (DomainSpoof, 14 days)Tencent CloudTencent Cloud (AS132203) · CNchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
binance[.]hu[.]netMail: SPF · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:48 UTC | 1 source · 1 record | Details |
ba[.]i7-binance[.]comMail: DMARC · checked 2026-10-19DMARC policy quarantine | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:47 UTC | 1 source · 1 record | Details |
j-binance[.]com2 hostnames under j-binance.comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive96.44.129.68 · Confirmed phishing host address (DomainSpoof, 14 days)ColoCrossingColoCrossing (AS36352) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
www[.]j-binance[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive96.44.129.68 · Confirmed phishing host address (DomainSpoof, 14 days)ColoCrossingColoCrossing (AS36352) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
k-binance[.]com[.]cnMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive118.139.164.57 · Confirmed phishing host address (DomainSpoof, 14 days)GoDaddyGoDaddy (AS26496) · US57.164.139.118.host.secureserver.netchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
lin-binance[.]com[.]cnMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive156.254.7.181 · Confirmed phishing host address (DomainSpoof, 14 days)CLOUDIE-AS-AP Cloudie Limited (AS55933) · HKchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
logo-binance[.]com[.]cnMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive156.254.7.181 · Confirmed phishing host address (DomainSpoof, 14 days)CLOUDIE-AS-AP Cloudie Limited (AS55933) · HKchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
lucn-binance[.]com[.]cnMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive156.254.7.181 · Confirmed phishing host address (DomainSpoof, 14 days)CLOUDIE-AS-AP Cloudie Limited (AS55933) · HKchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
luq-binance[.]com[.]cnMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
ba[.]m3-binance[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:47 UTC | 1 source · 1 record | Details |
marketbinance[.]comMail: MXSPF · checked 2026-10-19mail at Google (consumer mailbox) · sends via Google | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.21.50.84CloudflareCloudflare (AS13335) · US172.67.203.162CloudflareCloudflare (AS13335) · US2606:4700:3031::6815:3254CloudflareCloudflare (AS13335) · US2606:4700:3032::ac43:cba2CloudflareCloudflare (AS13335) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
mybinancewallet[.]orgMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
net-binance[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive168.222.65.180 · Confirmed phishing host address (DomainSpoof, 14 days)HKISP-AS-AP OWGELS INTERNATIONAL CO., LIMITED (AS153656) · HKchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
noreply-binancetr[.]comMail: MXSPFDMARC · checked 2026-10-19mail at Google (consumer mailbox) · DMARC policy none (monitor only) · sends via Google | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive198.185.159.144SquarespaceSquarespace (AS53831) · US198.185.159.145SquarespaceSquarespace (AS53831) · US198.49.23.144SquarespaceSquarespace (AS53831) · US198.49.23.145SquarespaceSquarespace (AS53831) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
not-reply-binance[.]comMail: MXSPFDMARC · checked 2026-10-19mail at GoDaddy (web / mail hosting) · DMARC policy quarantine · sends via GoDaddy | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive13.248.243.5Amazon Web ServicesAmazon Web Services (AS16509) · USa16e665f42988324c.awsglobalaccelerator.com76.223.105.230Amazon Web ServicesAmazon Web Services (AS16509) · USa16e665f42988324c.awsglobalaccelerator.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
ok-binance[.]comMail: DMARC · checked 2026-10-19DMARC policy quarantine | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive118.139.164.57 · Confirmed phishing host address (DomainSpoof, 14 days)GoDaddyGoDaddy (AS26496) · US57.164.139.118.host.secureserver.netchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
onchain-binance[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.21.56.221CloudflareCloudflare (AS13335) · US172.67.156.32CloudflareCloudflare (AS13335) · US2606:4700:3035::6815:38ddCloudflareCloudflare (AS13335) · US2606:4700:3035::ac43:9c20CloudflareCloudflare (AS13335) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
231 registrable domains · 234 hostnames · page 8 of 10← PreviousNext →
A feed listing or DNS answer alone cannot confirm current phishing. Removal from a feed does not confirm resolution.