trturksars[.]click

The domain trturksars.click was observed hosting a brand‑impersonation page targeting Binance users. The site presented the page title “Giriş Yap | Binance TR”, indicating an attempt to lure Turkish‑speaking visitors into a credential‑harvesting flow. Registration data show the domain was created on 27 October 2025 through Dynadot LLC and uses the authoritative name servers ns1.dyna‑ns.net and ns2.dyna‑ns.net. DNS resolution points to the IPv4 address 78.159.156.57, which belongs to AS25211 Euro Crypt EOOD and is geolocated in the Netherlands.

No TLS certificate was observed, meaning the site served traffic over plain HTTP. The domain is currently taken offline, and the phishing‑defense service PhishDestroy has already blocked it. VirusTotal analysis recorded 15 detections out of 95 scanning engines, confirming malicious classification. Additionally, AlienVault OTX has referenced the domain in 17 distinct threat‑intel pulses, and it appears on one external security blocklist.

The combined evidence—brand impersonation of Binance, a crypto‑scam label, detection by multiple vendors, and hosting on a known cryptocurrency‑related ASN—supports an elevated risk rating. Defenders should add the domain and its resolved IP to network deny lists, monitor for future registrations using the same registrar and name‑server pair, and enforce strict TLS‑only policies to prevent users from reaching unsecured credential‑collection pages. Continuous threat‑intel feeds should be consulted for any resurgence of the infrastructure, and endpoint protection solutions should be updated with the observed indicator set.