Phishing detection: binanceidentityportal.com

Binance
https://binanceidentityportal.com Access site
Screenshot
Screenshot of binanceidentityportal.com
Investigate
Domain binanceidentityportal.com0 CT hosts on apex
urlscan page.domain VirusTotal Whois

See every phishunt record for this domain

IP 104.194.141.153
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://binanceidentityportal.com
urlscan Wayback archive.today
Cert -
crt.sh Censys Google CT
Phishunt analysis Beta
75 high suspicion likely_phishingheuristic risk score · not a probability
Why?
  • +5.3 Keyword match
  • +3.9 Password field
  • +3.7 Brand in domain label
  • +3.2 Young domain
  • +3.0 OpenPhish
  • +1.6 Favicon (kit)
  • +1.1 ASN reputation
  • +1.1 No CSP header
  • +1.1 No HSTS header
  • +0.9 No registrar lock
  • +0.7 Unrecognised DNS provider
  • +0.6 Login text in screenshot
  • +0.6 Registrar reputation
  • +0.6 Script exfil endpoint
  • +0.5 Long domain
  • +0.2 Suspicious TLD
  • Boosted to 75: Credential exfil kit
21 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting

Fake Binance identity portal on a lookalike domain with a password input and script exfiltration endpoint. Listed by OpenPhish, it harvests Binance account credentials and likely identity data. Hosted on a UK datacenter IP with no security headers.

Password fieldScript exfil endpointOpenPhish
AI-generated from stored detector signals - the AI never visited the site. · 2026-11-08 · confidence 93%
Domain & Network
Whois
Registrar Ultahost, Inc.
Network
IP 104.194.141.153
Country United KingdomUnited Kingdom
Hosting Joseph Hofmann trading as 'Tornado Datacenter GmbH & Co. KG'
ASN AS198983
TLS Cert -
External detection OpenPhish
CleanGoogle Safe Browsing · PhishTank · TweetFeed · urlscan.io
Report this phishing
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-11-08 01:02 UTC  ·  Last refreshed 2026-11-09 05:30 UTC