Highscore 55 · flagged Tuesday, October 13, 2026

binancenordics.app

Appeared in the .app zone on Tuesday, October 13, 2026; by the end of that day the census found other. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

brand in the name
matched: binance
+30
brand name at a retail registrar
matched: PDR Ltd. d/b/a PublicDomainRegistry.com
+8
brand in page title, not in the name
matched: cloudflare
+20
Registrar
PDR Ltd. d/b/a PublicDomainRegistry.com
Nameserver provider
Nameservers
emergentlabs.earth.orderbox-dns.com, emergentlabs.mars.orderbox-dns.com, emergentlabs.mercury.orderbox-dns.com, emergentlabs.venus.orderbox-dns.com
First-day state
other
HTTP status
409
Page title
DNS resolution error | binancenordics.app | Cloudflare
Has a form
no
Brand echoed
binance

Model opinions

Second opinionlooks like abusetarget: Binanceconfidence 80%· claude-opus-5-5

The name pairs the distinctive brand 'binance' with a plausible regional suffix ('nordics'). It was registered through a retail registrar (PDR) with third-party 'emergentlabs' orderbox nameservers, not Binance's own infrastructure. The page is only a Cloudflare 1001 DNS error with no content, which fits a brand-squat being staged; the Cloudflare branding is the error page itself, not impersonation.

First passsuspicioustarget: Binanceconfidence 65%· claude-haiku-4-5

The domain binancenordics.app contains the Binance brand name and was registered recently with generic nameservers (orderbox-dns), suggesting potential preparation for impersonation. However, the page is currently a Cloudflare DNS resolution error (1001) with no active content, login form, or deceptive material yet visible—this is consistent with either a misconfigured legitimate site or a phishing domain in setup. The name itself (Nordics variant) mimics Binance's regional branding patterns, ra

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Tuesday, October 13, 2026

Screenshot of binancenordics.app taken by the zone census on 2026-10-13

Same data as JSON: /api/zone/domain/binancenordics.app. This page is not indexed by search engines and does not link to the site it describes.