geocitarios[.]ru

Analysis of geocitarios.ru, observed on 23 July 2026, indicates an active crypto‑scam infrastructure that impersonates the Binance brand. The site presents the page title “Bitcoin Bank Breaker”, which aligns with the reported scam type. The domain resolves to the IP address 104.21.17.19, hosted within Cloudflare’s AS13335 network in the United States. Registration is handled through Cloudflare, Inc., and the authoritative nameservers are drake.ns.cloudflare.com and savanna.ns.cloudflare.com. No TLS certificate was detected, and the HTTP response returned status code 200, confirming that the service is reachable over plain HTTP.

Threat intelligence signals include a single entry on a security blocklist and a detection by PhishDestroy. On VirusTotal, fifteen of ninety‑five scanning engines flagged the domain, reflecting a moderate consensus of maliciousness. Gridinsoft assigned a trust score of 0 out of 100, and AlienVault OTX recorded the domain in one threat‑intel pulse, reinforcing its classification as a crypto‑related scam. The combination of brand impersonation, a convincing page title, and the lack of encryption suggests an attempt to lure Binance users into disclosing credentials or funds. Uncertainties remain regarding the exact payload delivered to victims, as no sample of the landing page content or associated malicious binaries has been published.

Additionally, the low number of blocklist entries may indicate limited exposure or recent deployment. Defenders should block DNS resolution for geocitarios.ru at the network perimeter, enforce HTTPS‑only policies to mitigate downgrade attacks, and monitor outbound connections to the Cloudflare‑hosted IP address. Endpoint security solutions should be updated to include the fifteen VirusTotal detections, and threat‑intel feeds should be enriched with the OTX pulse reference. Continuous re‑scanning is recommended to capture any evolution of the site’s infrastructure or content.