esspresso[.]click

Analysis of esspresso.click, observed as a brand‑impersonation campaign targeting Binance, shows a concrete set of artifacts that merit heightened vigilance. The domain was registered on December 30, 2025 through NameSilo, LLC and is hosted on Cloudflare infrastructure (AS13335) with the resolved address 172.67.207.189, located in the United States. Nameservers listed are hugh.ns.cloudflare.com and walk.ns.cloudflare.com. The site presented the page title "Espresso Claim Portal" and is associated with an Airdrop Scam phishing kit, a pattern commonly used to lure cryptocurrency users.

No SSL certificate was detected, indicating an unencrypted HTTP service at the time of capture. Detection signals include presence on a single security blocklist and a block by PhishDestroy, while Google Safe Browsing classified the domain as social engineering. VirusTotal reported that five of ninety‑three security vendors flagged the domain, reinforcing the malicious assessment. Independent reputation scoring from Gridinsoft assigned a trust score of 0 out of 100.

Although the site is currently offline, the combination of registrar information, hosting details, kit attribution, and multiple vendor detections confirms a credible threat. Defenders should continue to block the domain at perimeter devices, monitor for any resurgence of the host IP or related Cloudflare‑associated subdomains, and update threat‑intel feeds with the identified indicators of compromise. Organizations that use Binance services should educate users about the "Espresso Claim Portal" lure and enforce strict verification of legitimate Binance communications. Uncertainty remains only around the exact content of the compromised page, as no visual analysis is available; however, the existing evidence is sufficient to treat esspresso.click as a malicious actor and to apply appropriate defensive controls.