binancezh.top - Why was this used on a valid email from Binance.com

I have tried to contact Binance support about this - but its harder than it sounds - so I'll put this here in case it is of use to someone else.

When helping a friend who's details had been used fraudulently by a scammer to create an account on Binance we found ourselves in a loop of mistrust and suspicion when the 'click here to disable your account link' they received, took them to a domain that looked very suspicious itself (binancezh.top).
From there the process of disabling an account that was created fraudulently became incredibly difficult.
I use Binance myself every day and I trust them with my $ but this experience put me in the shoes of a newbie and it was quite daunting.

This was further compounded by it being really hard to find anything on the Binance.com website that made it easy to report or validate domain names, of course there was plenty of chatbots keeping you company.

What did I find? I tried all the usual WhoIs tools and I checked the SSL security certificate - but you can never tell if the 'owners details' are valid anyway. I searched the Binance.Com site for any pages that contained "binancezh.top" and there was 4 results (see images posted) although this is only in the cached search results.

It does highlight a dumb aspect of trusting SSL certificates, the certificates might be "valid" but how does anyone know if they were issued to the 'correct business'? But that's a squabble for another day

So this domain was/is 'probably' a valid Binance domain and it looks and behaves like binance.com in all respects but it feels super dodgy.

Why do I care? Domain names should clearly reflect the business you are dealing with. We all know scammers love a good replica site and they will use a domain name that 'looks' almost right. This situation presents as if it is a scam, and given that this was our mindset this felt a fair assessment at the time. Maybe it is?

Happy to update this if someone has more / better information.

Valid email received from \"[email protected]\"

​

The 'valid' Binance logon page at https://accounts.binancezh.top/

​

Web search showing Cached results where this domain was referenced on binance.com