sarjalk[.]click

This domain, sarjalk.click, is flagged as a brand impersonation phishing site specifically targeting Binance, a major cryptocurrency exchange platform. The page title, "Giriş Yap | Binance TR," mimics the legitimate Binance Turkey login portal, suggesting an intent to deceive users into entering credentials or financial information. No drainer kit signatures were identified in the available data, but the domain’s structure and content align with credential harvesting tactics commonly used in phishing campaigns.

Analysis indicates the domain was registered on October 10, 2025, through Dynadot LLC, a registrar frequently associated with malicious domains. It resolves to the IP address 78.159.156.48, hosted on AS25211 (Euro Crypt EOOD) in the Netherlands. The domain lacks an SSL certificate, a red flag for secure communication. VirusTotal reports 18 out of 95 security vendors flagging this domain as malicious, while it appears on one security blocklist. No Google Safe Browsing (GSB) detections were recorded at the time of analysis, though this may reflect a lag in reporting rather than a clean status.

As of the latest assessment, sarjalk.click has been taken offline, likely due to hosting provider intervention or registrar enforcement. However, the domain remains registered, posing a residual risk of reactivation or migration to alternative infrastructure. Users who interacted with this domain should assume credential compromise and initiate password resets on associated accounts. Organizations are advised to monitor for similar domains registered through Dynadot or resolving to the same IP range, as threat actors often reuse infrastructure across campaigns.