Binance's official mirror gateways adjust frequently, with new domains popping up one by one. The most common confusion for regular users is: "Is this binance-xxx link sent in the group chat real?" Here is the direct answer: Official mirrors will always redirect back to the main binance.com domain, and they will all be synchronized in announcements or within the app. This article provides a 4-step self-test method. For daily use, it is recommended to enter through the verified Binance website gateway, use the Binance official app on mobile, and if you don't have the iOS app installed, see the iOS install guide.
1. Overview of the Four-Step Self-Test
| Step | Action | Judging Criteria | Time Taken |
|---|---|---|---|
| 1 | Check redirection to main domain | Does it redirect back to binance.com when logging in or accessing sensitive pages? | 30 seconds |
| 2 | Check HTTPS certificate | Is the issued entity associated with Binance Holdings? | 30 seconds |
| 3 | Query WHOIS | Is the registrant info reasonable? (Often obscured by proxies, but leaves clues) | 1 minute |
| 4 | Compare with in-app announcements | Is there a matching announcement inside the Binance app? | 1 minute |
You must pass all four steps to use it; if any step fails, abandon it immediately.
2. Step 1: Check Redirection to the Main Domain
Open the alleged "mirror gateway" and click the "Log In" button in the top right corner. Observe the address bar:
- ✅ Redirects to accounts.binance.com or binance.com/zh-CN/login: It is a real mirror (acting just as a routing layer).
- ❌ Redirects to other domains like xxx-login.top / xxx-account.vip: 100% phishing.
Any "mirror" that fails to redirect even the login page to the main binance.com domain is undoubtedly fake. This is the fastest and most effective verification action.
3. Step 2: Check the HTTPS Certificate
Click the small padlock icon in the address bar → Certificate. Focus on two fields:
Issued To (Subject) / SAN
It should contain *.binance.com or exactly binance.com. If it is any other arbitrary domain, it was definitely not signed by Binance.
Issuer
It should be a public CA: DigiCert / Sectigo / GlobalSign / Cloudflare Inc. If it is Let's Encrypt, there is no need to panic (many CDNs use LE), but you must combine it with the Subject for judgment.
Validity Period
A genuine certificate's validity usually spans from 90 days to 1 year. Anything valid for over 2 years or less than 24 hours is abnormal.
4. Step 3: Query WHOIS
Open who.is or ICANN Lookup, and enter the domain to query:
Registrant Type
- Corporate Registration (Binance Holdings / Binance Operations, etc.): Trustworthy.
- Privacy Proxy (Privacy Proxy / Domains by Proxy): Most large corporations use proxies nowadays, so you cannot determine authenticity based on this alone.
- Personal Registration: Basically guaranteed to be phishing.
Registration Date
Genuine mirrors have registration dates spanning at least several years. If a domain was registered just a week ago and claims to be a Binance mirror, it is definitely fake.
DNS Providers
The Name Servers (NS) for genuine mirrors are usually major providers like Cloudflare or AWS Route 53. If the NS belongs to an unknown, small provider, be highly alert.
5. Step 4: Compare with In-App Announcements
The official Binance app synchronizes all compliance and operational information in the "Announcement Center". Any adjustment to real mirror gateways will definitely be accompanied by a synchronized announcement.
How to check:
- Open the Binance app.
- Go to "More" at the bottom of the home page → "Help / Announcements".
- Search for keywords like "mirror", "alternative domain", or "backup gateway".
- Check if the domain was mentioned within the last month.
If the domain you have is not in the app's announcements, and combined with any doubts from the previous three steps, the conclusion is do not use it.
6. Common Judgment Errors
Error 1: Believing It Because a Friend Said It Was Real
Your friends can be scammed too. Social engineering attacks spread through "old user → friend → friend's friend". Verification cannot rely on social trust.
Error 2: Thinking It's Real Just Because You Logged In
Phishing sites can create a perfect "fake login"—after you input your username and password, the page throws an error message, but your password has actually already been logged. A single "successful" login attempt does not prove the site is real.
Error 3: Believing It Because the UI Looks Identical
The UI of a phishing site is generated by directly copying the official website's code, so an identical appearance is entirely expected. Looking at the URL and the certificate is the only effective method.
7. The Correct Sequence for Finding Mirror Gateways
- Prioritize the App: The official app connects directly to APIs and doesn't suffer from domain issues.
- In-App Announcement Pages: Mirrors accessed through these links are the most trustworthy.
- Gateways Verified by This Site: Our site updates verified gateways weekly.
- Binance Official X / Telegram Channels: Pay close attention to verified accounts only.
- Links from Group Members: Default to mistrust; you must perform the 4-step self-test.
FAQ
Q1: Mirrors change frequently, are there any "long-term stable" gateways? The main domain binance.com is permanently stable. Mirrors are just traffic-routing gateways that ultimately redirect to the main domain. If you can connect directly to the main domain, you do not need mirrors at all.
Q2: I can't find this mirror in the app's announcements, but many people are using it. Can I use it? Pass the 4-step self-test first. However, it is always recommended to prioritize gateways that have appeared in the app's announcements.
Q3: Do I need to re-test after passing the self-test once? We recommend re-testing once a month. Mirror gateways might become invalid or change ownership due to compliance adjustments, and skipping re-tests could lead you to click on an expired, malicious link.
Q4: Will logging in via a mirror get my account flagged by risk control? No. A mirror is essentially just an entry point at the routing layer; your account resides on the main domain servers.