<blockquote>
<p>If it's a fraud, how could they have sent a fraudulent link through a real binance email address?</p>
</blockquote>
<p>It has long been trivial to forge the &quot;from&quot; address in Internet e-mail. You could learn how to do it in about thirty seconds.</p>
<p>See <a href="https://en.wikipedia.org/wiki/Email_spoofing" rel="nofollow noreferrer">https://en.wikipedia.org/wiki/Email_spoofing</a></p>
<blockquote>
<p>The core email protocols do not have any mechanism for authentication, making it common for spam and phishing emails to use such spoofing to mislead or even prank the recipient about the origin of the message.</p>
</blockquote>
<p>The link above goes on to describe countermeasures - but note these are not universally applied.</p>

CC BY-SA 4.0
2021-01-07T15:07:09.643Z
Even still, I initiated the email flow from the real Binance site
Jordan
CC BY-SA 4.0
2021-01-07T11:22:00.030Z
2021-01-07T11:22:00.030Z
RedGrittyBrick
<p>It looks fraudulent to me, because of the domain. The .cc extension is for the Cocos Islands, and Binance would not use it. They usually tell you to carefully check you are using the right domain. An e-mail can easily be made to look from the right party when it's not.</p>
<p>I would speak to Binance support. Their correct domain is:</p>
<p><a href="https://www.binance.com/" rel="nofollow noreferrer">https://www.binance.com/</a></p>

CC BY-SA 4.0
2021-01-07T15:34:49.900Z
I've opened a ticket with Binance, thanks
Jordan
CC BY-SA 4.0
2021-01-07T15:09:28.250Z
2021-01-07T15:09:28.250Z
Atrix
<p>I checked with Binance support, and they gave me a tool they have to check if a site is official. According to this, the site is official. I am guessing they have this site because they operate a decentralised business structure, hence the .cc domain for the Cocos Islands, an Australian territory.</p>

CC BY-SA 4.0
2021-01-12T13:24:42.453Z
2021-01-12T13:24:42.453Z
Atrix
<p>I was attempting to reset my authenticator through the real binance site and somehow I got redirected to binancezh.cc which was immediately alarming to me when I noticed; however, upon further investigation, one of the links that led to binancezh.cc was in an automated email sent from binance.com.</p>
<p>How could I have been redirected to a fraudulent site from an interaction that I initiated on the real site?</p>
<hr />
<p>Edit: It appears that the site is somehow legit but not intended for public use
<a href="https://www.reddit.com/r/binance/comments/krt1he/binancezhcc/gif9ca0?utm_source=share&amp;utm_medium=web2x&amp;context=3" rel="nofollow noreferrer">https://www.reddit.com/r/binance/comments/krt1he/binancezhcc/gif9ca0?utm_source=share&amp;utm_medium=web2x&amp;context=3</a></p>

CC BY-SA 4.0
2021-01-07T05:33:14.493Z
How did you verify that the email was authentic and the sender address not just spoofed? Did you check DMARC, DKIM?
Murch
CC BY-SA 4.0
2021-01-07T15:06:41.903Z
I didn't, I will check that
Jordan
CC BY-SA 4.0
2021-01-07T15:46:54.663Z
@Murch, I have validated the DKIM
Jordan
<fraud>
Redirected from a real exchange site to a fraudulent site?
Jordan
# Redirected from a real exchange site to a fraudulent site?

(Asked by: username_0 on 2021-01-07)

I was attempting to reset my authenticator through the real binance site and somehow I got redirected to binancezh.cc which was immediately alarming to me when I noticed; however, upon further investigation, one of the links that led to binancezh.cc was in an automated email sent from binance.com.

How could I have been redirected to a fraudulent site from an interaction that I initiated on the real site?

---

Edit: It appears that the site is somehow legit but not intended for public use
<https://www.reddit.com/r/binance/comments/krt1he/binancezhcc/gif9ca0?utm_source=share&utm_medium=web2x&context=3>

**Tags:** fraud

> **Comments:**
> **username_1**: How did you verify that the email was authentic and the sender address not just spoofed? Did you check DMARC, DKIM?  
> **username_0**: I didn't, I will check that  
> **username_0**: @username_1, I have validated the DKIM  

---

## 3 answers

### Answer by username_2 on 2021-01-07. Score: 1

> If it's a fraud, how could they have sent a fraudulent link through a real binance email address?

It has long been trivial to forge the "from" address in Internet e-mail. You could learn how to do it in about thirty seconds.

See <https://en.wikipedia.org/wiki/Email_spoofing>

> The core email protocols do not have any mechanism for authentication, making it common for spam and phishing emails to use such spoofing to mislead or even prank the recipient about the origin of the message.

The link above goes on to describe countermeasures - but note these are not universally applied.

> **Comments:**
> **username_0**: Even still, I initiated the email flow from the real Binance site  

---

### Answer by username_3 on 2021-01-07. Score: 1

It looks fraudulent to me, because of the domain. The .cc extension is for the Cocos Islands, and Binance would not use it. They usually tell you to carefully check you are using the right domain. An e-mail can easily be made to look from the right party when it's not.

I would speak to Binance support. Their correct domain is:

<https://www.binance.com/>

> **Comments:**
> **username_0**: I've opened a ticket with Binance, thanks  

---

### Answer by username_3 on 2021-01-12. Score: 0

I checked with Binance support, and they gave me a tool they have to check if a site is official. According to this, the site is official. I am guessing they have this site because they operate a decentralised business structure, hence the .cc domain for the Cocos Islands, an Australian territory.


---

