Indicators
Hosts named in advisories
Every host that appears in an advisory, with the advisory it came from. Published defanged. 8 hosts across 5 advisories.
This is not a blocklist. Do not apply it wholesale. These campaigns work by abusing legitimate services, so genuine infrastructure appears in this list beside hostile infrastructure — a real exchange's own domain and shortener sit here precisely because the attack routed through them. Nothing here marks which is which, and blocking a legitimate host would break real access for your users. Read the advisory each host links to before acting on it.
Handling. Hosts are written inert —
[.] in place of a dot — and are deliberately not links. Do not reconstruct or visit them.| Host | Named in |
|---|---|
| 0691[.]app | |
| accounts[.]authenticated[.]binancc[.]cdn378129[.]com | |
| accounts[.]authentication[.]binance[.]com73184[.]com | |
| binance[.]com | |
| bnbshort[.]com | |
| cdn378129[.]com | |
| com73184[.]com | |
| s[.]binance[.]com |
Captured payloads and SHA-256 manifests are available to abuse desks, registrars and CERTs on request: [email protected].