Phishing detection: binanceaa.com

Binance
https://binanceaa.com Access site
Screenshot
Screenshot of binanceaa.com
Investigate
Domain binanceaa.com1 CT host on apex
urlscan page.domain VirusTotal Whois
IP 156.254.5.40
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://binanceaa.com
urlscan Wayback archive.today
Cert Let's Encrypt
crt.sh Censys Google CT
Phishunt analysis Beta
25 low suspicionheuristic risk score · not a probability
Keyword matchBrand in domain labelurlscan.io
16 signals fired · detector v2.0.0
AI analysis AIBeta
Credential harvesting

Typosquatting domain impersonating Binance cryptocurrency exchange, part of a cluster of lookalike domains sharing the same Malaysian hosting infrastructure and abuse-flagged ASN. Flagged as malicious by urlscan; targets exchange login credentials.

Brand in domain labelASN reputationurlscan.io
AI-generated from stored detector signals - the AI never visited the site. · 2026-07-23 · confidence 65%
Domain & Network
Whois
Registrar July Name Limited
Network
IP 156.254.5.40
Country MalaysiaMalaysia
Hosting Cloudvalley Sdn. Bhd.
ASN AS154376
TLS Cert Let's Encrypt
External detection urlscan.io
CleanGoogle Safe Browsing · OpenPhish · PhishTank · TweetFeed
Related infrastructure Betasuspected links from shared infrastructure, not attribution
Suspected cluster #286 · 3 indicators · confidence High · targets: Binance
binancenn.com 72 same IP same nameservers similar name same registrar same TLS cert shared TLS SAN
active 2026-05-20
binanceii.com 72 same IP same nameservers similar name same registrar same TLS cert shared TLS SAN
active 2026-05-20
Top 2 of 2 related · rebuilt daily · corr-1.2.0 · related infrastructure API
Report this phishing
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-05-20 21:10 UTC  ·  Last refreshed 2026-08-11 07:30 UTC