Phishing detection: case-binance.us

Binance
https://case-binance.us Access site
Screenshot
Screenshot of case-binance.us
Investigate
Domain case-binance.us1 CT host on apex
urlscan page.domain VirusTotal Whois

See every phishunt record for this domain

IP 2.58.56.150
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://case-binance.us
urlscan Wayback archive.today
Cert YE1
crt.sh Censys Google CT
Phishunt analysis Beta
12 noiseheuristic risk score · not a probability
Why?
  • +5.3 Keyword match
  • +1.1 ASN reputation
  • +1.1 No CSP header
  • +1.0 Site cluster
  • +0.7 Brand in cert SAN
  • +0.7 Unrecognised DNS provider
  • +0.6 Final host mismatch
  • +0.6 Suspicious TLD
  • +0.5 Young certificate
  • +0.3 Free CA
  • +0.3 Long domain
  • +0.1 Hyphens
17 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting

Site impersonates Binance with brand-related keywords consistent with a cryptocurrency credential harvesting attempt. Uses a hyphenated brand domain pattern, routes through bulletproof infrastructure in the Netherlands, and passes through multiple redirect hops before reaching its final destination.

Keyword matchNo brand linksUnrecognised DNS provider
AI-generated from stored detector signals - the AI never visited the site. · 2026-09-19 · confidence 50%
Domain & Network
Whois
Network
IP 2.58.56.150
Country The NetherlandsThe Netherlands
Hosting 1337 Services GmbH
ASN AS210558
TLS Cert YE1
External detection No external source flags this
CleanGoogle Safe Browsing · OpenPhish · PhishTank · TweetFeed · urlscan.io
Related infrastructure Betasuspected links from shared infrastructure, not attribution
authentication.citrix-sharing.com 43 similar text same redirect target same rare cert issuer same favicon same screenshot
active 2026-08-23
thomas-coinbase.com 41 similar text same redirect target appeared together (24h) same favicon same screenshot
active 2026-09-19
buscarmi-icloud.app 40 similar text same redirect target same favicon same screenshot
active 2026-09-07
microsoft.vpn-update.org 40 similar text same redirect target same favicon same screenshot
active 2026-08-09
t54632-kraken.com 40 similar text same redirect target same favicon same screenshot
active 2026-09-11
Top 5 of 5 related · rebuilt daily · corr-1.3.0 · related infrastructure API
Report this phishing
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-09-19 17:26 UTC  ·  Last refreshed 2026-09-20 15:30 UTC