narsalk[.]click

Analysis of the domain narsalk.click confirms its classification as a Binance-branded crypto phishing site, now offline. The domain was registered on October 10, 2025, through Dynadot LLC and resolved to the IP address 78.159.156.48, hosted on AS25211 (Euro Crypt EOOD) in the Netherlands. Infrastructure analysis reveals the use of nameservers ns1.dyna-ns.net and ns2.dyna-ns.net, with no SSL certificate detected. The page title, 'Giriş Yap | Binance TR,' explicitly targets Turkish-speaking Binance users, aligning with the reported scam type of a crypto scam.

Detection data supports the malicious classification: the domain appears on one security blocklist and is flagged by 16 of 95 security vendors on VirusTotal, though the absence of additional context limits granular assessment of detection rules. AlienVault OTX records the domain in 16 threat intelligence pulses, indicating prior reporting by multiple sources. The domain is also blocked by PhishDestroy, further corroborating its phishing status. Defenders should treat this domain as a confirmed threat, particularly for Binance users in Turkish-language regions.

The lack of SSL and the use of a hosting provider with a history of abuse (AS25211) are consistent with phishing infrastructure patterns. While the site is currently offline, historical resolution data and detection records justify continued monitoring and blocking. No evidence suggests this domain is part of a broader campaign, but the targeting of a major crypto exchange warrants heightened scrutiny for related domains or IPs. Organizations should review logs for connections to 78.159.156.48 or the domain itself and update blocklists accordingly.