Binance's security announcement for the fourth quarter of 2025 showed that more than 1,200 phishing domains were intercepted throughout the year, with an average of 80 fake sites added every month. The vast majority of these sites target two goals: stealing account passwords + intercepting Google verification codes. Once you enter these two items on a fake site, attackers can initiate a fund transfer within 30 seconds. The most reliable way to avoid falling into a trap is to obtain verified entries directly from the Binance Official Site or download the Binance Official APP and use the APP channel. If you are used to logging in with a browser, the 5 identification features given in this article are enough to cover 99% of current phishing methods.
1. Why Phishing Sites Are So Hard to Identify
Advances in Cloning Technology
Fake sites before 2023 were relatively crude, with visible differences in page fonts, icons, and color codes. Phishing sites after 2024 generally use Puppeteer + Chrome Headless to crawl the full HTML/CSS/JS of the real site and then perform mirror deployment, which is visually almost indistinguishable from the real site. Some even forward the real-time WebSocket stream of the real site to users, so that the coin price dynamics and K-line charts are real, and only hijack the login interface.
Increased Attacker Investment
The technology stack used by high-value fake sites includes:
- Domains: Acquiring old domains (3-5 years old) through secondary markets to avoid new domain risk control scores;
- Certificates: Paid DigiCert OV certificates let browsers display the 🔒 icon;
- CDN: Using Cloudflare Pro plans (£20/month) for fast response;
- Ad Placement: Batch placement of Google Ads, Bing Ads, and Twitter Ads, immediately switching accounts if banned;
- SMS Bombing: Sending mass text messages like "Your account is abnormal, please log in to binance-xxx.com immediately to verify."
The higher the investment in a fake site, the harder it is to distinguish, which is why a systematic checklist must be used instead of intuition.
2. Feature 1: Domain Spelling and Suffix Abnormalities
Common Spelling Variants
The real Binance domain will always be one of the following:
binance.com(Main site)binance.us(US entity)binance.info/binance.bz/binance.org(Global mirrors)binance.co.jp/binance.com.au(Regional compliance)
Spelling variant categories for fake sites:
| Type | Example | Identification Tip |
|---|---|---|
| Letter Replacement | binanca.com, bInance.com | Case-sensitive I/l/1 confusion |
| Letter Addition/Deletion | binnace.com, binancce.com | One more or one less letter |
| Letter Order | biannce.com, bincane.com | Two letters reversed |
| Prefix/Suffix Addition | binance-vip.com, mybinance.com | Adding vip/pro/cn/login, etc. |
| Heterogeneous Suffixes | binance.top, binance.xyz, binance.live | Non-official TLDs |
| Subdomain Disguise | login.binance-safe.net | Placing "binance" in a second-level domain |
Practical Check Method
Look at the full URL at the far left of the browser address bar and check every character from the protocol to the path. If the URL is too long to see in full, you can copy and paste it into Notepad to enlarge it.
Chrome / Edge users are recommended to enable "Always show full URL": right-click on the address bar → "Always show full URL". This prevents seeing a folded main domain.
3. Feature 2: Certificate Authority and Validity Period
Real Binance Certificate Configuration
Open the real Binance website with Chrome, click 🔒 → "Certificate Information", and you can see:
- Issuer: DigiCert Inc (Main site) / Cloudflare Inc (Mirrors)
- Subject: *.binance.com (Wildcard)
- Certificate Type: Extended Validation (EV) or Organization Validated (OV)
- Validity Period: Usually 13-15 months
- Company Information: BINANCE HOLDINGS LIMITED, CH (Specific to EV certificates)
Phishing Site Certificate Features
- Issuer: Almost all use Let's Encrypt or ZeroSSL free certificates;
- Certificate Type: Only Domain Validated (DV), containing no organizational information;
- Short Validity Period: Let's Encrypt certificates default to 90 days;
- Wildcard Scope: The Subject might be the fake site's own domain, unrelated to binance.
The application for an EV certificate requires a real-name audit of the corporate legal person, with an average audit cycle of 7-10 days and costs starting at $200. Fake sites won't spend this money. If you see that the certificate authority is not DigiCert, it can basically be determined as a fake site.
Extra Tips for Enterprise Browsers
Chrome for Business and Edge for Business enable Certificate Transparency verification by default, which actively compares whether the certificate appears in public CT logs. Binance certificates not issued by official authorities will trigger a "NET::ERR_CERT_COMMON_NAME_INVALID" interception.
4. Feature 3: Login Process Abnormalities
Real Binance Login Process
- Access
accounts.binance.com/login; - Enter email/mobile number and click "Next";
- Enter password;
- A slider verification or puzzle verification might pop up (not always);
- Enter 2FA (email code/SMS code/Google Authenticator);
- After a successful login, it jumps to the binance.com homepage, with an Anti-phishing Code displayed at the top.
Throughout the entire process, the Anti-phishing Code will only be displayed after logging into an account that has already set it up. Fake sites cannot forge this field.
Abnormal Performance of Fake Sites
- Requiring all credentials at once: Entering account + password + 2FA on the same page (the real site is step-by-step);
- Forced download of "security plugins": Requiring the installation of .exe / .apk files to continue logging in;
- Jumping to random pages after successful login: The real site always jumps to the binance.com homepage or the last page you visited;
- Anti-phishing code field is blank or shows a default value;
- Unsupported 2FA method actually bound by you: For example, your account is bound to Google Authenticator, but the fake site only asks for an SMS code.
Role of Anti-phishing Code
The Anti-phishing Code is a 6-8 digit string you customize in the Binance Security Center. All official Binance emails, the top bar of pages after logging in, and internal messages will carry this code. Phishing sites don't know your anti-phishing code, so they either leave it blank or use a default value like "Binance" to pretend. If the anti-phishing code seen after logging in is inconsistent with what you set → exit immediately and change your password.
5. Feature 4: WHOIS and DNS Features
WHOIS Check
Use whois binance.com to query, key fields:
- Registrar: MarkMonitor, Inc. (Professional brand protection provider)
- Creation Date: 2017-04-20T00:00:00Z
- Registrant Organization: Binance Holdings Limited
- Registrant Country: VG (British Virgin Islands) / CH (Seychelles)
- Name Servers: dns1.p08.nsone.net and other NS1 managed servers
WHOIS Abnormalities of Fake Sites
- Registrar: Cheap registrars like GoDaddy, NameCheap, Porkbun, Gandi, etc.;
- Registration Time: Created within the last 30-180 days;
- Registrant: Usually hidden (Privacy Protection) or a personal email;
- Name Servers: Using free DNS services (such as Cloudflare Free, DNSPod);
- Country: Mostly privacy-friendly locations like the US, Panama, Cayman, etc.;
- Multiple Binance-like domains under the same IP: An IP bound to dozens of domains like binance-xxx.com, bnb-yyy.com, crypto-zzz.com → a typical phishing cluster.
Recommended Tools
- whois.domaintools.com — Visual query interface;
- securitytrails.com — Provides historical DNS records, allowing you to see IPs the domain was once bound to;
- virustotal.com — Enter the URL to see risk scores from multiple security vendors;
- urlscan.io — Automatically crawls page screenshots and network requests, allowing you to see the real request targets of the page.
6. Feature 5: Social Engineering Trigger Paths
Common Induction Methods
Phishing sites don't have traffic on their own; they must rely on induction. Common tricks in 2025-2026:
- "Abnormal Login" Email: Forging the Binance sender address, the body says "suspicious login detected, please verify immediately," with a fake link attached;
- Airdrop/Cashback Ads: "Binance new user airdrop 500 USDT" links on Twitter, YouTube, and Telegram;
- Private Chat in Groups: Someone actively adds you on WeChat/TG, saying they are "Binance customer service" helping to handle the account;
- SMS Phishing (SMiShing): Receiving "Your Binance account 2FA failed, click xxx.cn to reset" on your phone;
- Google/Bing Search Ads: The top-ranked paid ad when searching for "Binance login" is a fake site;
- QR Code Login Phishing: Giving you a QR code and saying you can get a VIP gift pack by scanning it, which actually transfers your APP login status to the attacker.
Fundamental Principles of Defense
Binance never actively contacts users to request a login. Any "official link" sent via email, SMS, QQ, WeChat, or TG must be verified for its source. Verification methods:
- Compare with the official domains listed on the Binance Official Site;
- Don't click links in emails; enter the domain manually to visit;
- Customer service communication is only through the Binance APP or the internal chat system at
binance.com/support; - The official Binance X account @binance has blue certification; others claiming to be "Binance Chinese" or "Binance Customer Service" are mostly fake.
7. Recommended Browser Protection Plugins
Free and Effective Plugins
| Plugin | Main Function | Applicable Browsers |
|---|---|---|
| uBlock Origin | Filter fake site ads and redirects | Chrome / Edge / Firefox |
| MetaMask | Built-in phishing domain blacklist | Chrome / Edge / Firefox / Brave |
| PhishFort | Crypto-industry specific phishing identification | Chrome |
| Netcraft | Real-time phishing scoring | Chrome / Firefox / Edge |
| Scam Sniffer | Blockchain-related phishing detection | Chrome / Firefox |
| HTTPS Everywhere | Enforce HTTPS (prevent MITM) | Firefox |
After installation, it is recommended to add binance.com, binance.us, binance.info, binance.bz, and accounts.binance.com to the plugin whitelist to avoid accidental interception of official domains.
Browser Built-in Protection
- Chrome: Enable Enhanced Protection at
chrome://settings/security; - Edge: Enable Microsoft Defender SmartScreen;
- Firefox: Enable Enhanced Tracking Protection → Strict;
- Safari: Preferences → Privacy → Prevent Cross-site Tracking.
8. Correct Handling Process When Encountering a Fake Site
Opened but Haven't Entered Credentials
- Close the tab immediately;
- Clear browser history (specifically for that URL);
- If it's from an email, mark the email as spam/phishing;
- Report the URL to
[email protected]; - Also submit it to Google Safe Browsing (
google.com/safebrowsing/report_phish/).
Have Entered Account and Password
The situation is urgent. Complete all of the following within 30 minutes:
- Visit real Binance → change your password immediately;
- Unbind original 2FA and rebind Google Authenticator;
- Change Anti-phishing Code;
- Close API keys (delete all and rebuild);
- Check login IPs and devices from the last 24 hours;
- Enable Withdrawal Whitelist, restricting withdrawals only to your trusted addresses;
- Apply for Full Account Freeze (24-hour emergency lock) on the fund security page.
After completing the above operations, even if the attacker has obtained your old credentials, they cannot move funds. Then complete the defense according to the in-depth setup tutorial in the [Security Hardening](/en/vault/Security Hardening/) category.
Coins Already Stolen
- Contact manual customer service in the Binance APP as soon as possible;
- Submit the stolen transaction hash and timestamp;
- Binance risk control will try to freeze stolen funds flowing to Binance accounts;
- Simultaneously report to the local public security organs (for subsequent on-chain tracking needs).
The recovery rate for stolen coins is proportional to the speed of reporting. The earlier you report, the higher the possibility of recovery.
Common Questions FAQ
Q1: How do phishing sites get my 2FA verification code?
A: Real-time Phishing. The attacker's server simulates a real Binance login client in the background, and the 2FA code you enter will be immediately forwarded to the real site to complete the login. This is why SMS/email 2FA is more dangerous than Google Authenticator — the former has a 5-minute validity period, which is enough for relaying. Using hardware U2F (YubiKey) can completely immunize against such attacks.
Q2: Will real Binance call me?
A: No. Binance official never actively contacts users via phone, WeChat, QQ, Telegram, etc. Anyone claiming to be Binance customer service, asking you to download an APP, or install screen-sharing software is a scammer.
Q3: Can browser bookmarks completely prevent phishing?
A: Basically, yes. If you only visit Binance through browser bookmarks, theoretically you won't jump to a fake site. But note — when adding the bookmark for the first time, you must ensure it's the real Binance, and never click "Binance Official Website" from search results, emails, or advertisements again. See Best Practices for Binance Official Website Bookmark Collection to Prevent Phishing for details.
Q4: Can the Binance APP be faked?
A: Yes. Someone has uploaded fake Binance APKs on GitHub and third-party app markets. Always obtain the genuine version from the APK download page of the Binance Official Site and check the SHA-256 signature after installation. iOS users who only download from the official App Store entry will have no problems.
Q5: How can I be sure the domain I've bookmarked is real?
A: Three-step verification — (1) Whether the main domain is the pure binance spelling and the suffix is in the official list; (2) The certificate authority is DigiCert; (3) The WHOIS registrar is MarkMonitor. If all three are met, it's confirmed. If you're still not sure, refer to Binance Official Website SSL Certificate Viewing and Verification Steps for deep verification.
Want to learn more about account security practices? Return to Category Navigation to enter the Security Hardening or Official Gateway categories, or directly view the latest articles in All Tutorials.