Indicators

Hosts named in advisories

Every host that appears in an advisory, with the advisory it came from. Published defanged. 9 hosts across 2 advisories.

This is not a blocklist. Do not apply it wholesale. These campaigns work by abusing legitimate services, so genuine infrastructure appears in this list beside hostile infrastructure — a real exchange’s own domain and shortener sit here precisely because the attack routed through them. Nothing here marks which is which, and blocking a legitimate host would break real access for your users. Read the advisory each host links to before acting on it.

Handling. Hosts are written inert — [.] in place of a dot — and are deliberately not links. Do not reconstruct or visit them.

Host	Named in
0691[.]app	The Binance Verification-Code SMS That Uses a Real Binance Link
accounts[.]authenticated[.]binancc[.]cdn378129[.]com	The Binance Verification-Code SMS That Uses a Real Binance Link
accounts[.]authentication[.]binance[.]com73184[.]com	The Binance Verification-Code SMS That Uses a Real Binance Link
binance[.]com	The Binance Verification-Code SMS That Uses a Real Binance Link
bnbshort[.]com	The Binance Verification-Code SMS That Uses a Real Binance Link
cdn378129[.]com	The Binance Verification-Code SMS That Uses a Real Binance Link
com73184[.]com	The Binance Verification-Code SMS That Uses a Real Binance Link
event[.]polarnode[.]vip	Opening the Page Is the Download
s[.]binance[.]com	The Binance Verification-Code SMS That Uses a Real Binance Link

Captured payloads and SHA-256 manifests are available to abuse desks, registrars and CERTs on request: threat@uniauth.id.