card[.]invierteseguro[.]lat

This domain, card.invierteseguro.lat, presents an elevated-risk credential harvesting operation targeting users of Binance Visa card services. The site displays a fraudulent page titled 'Tarjeta Binance Visa - Paga con Criptomonedas,' designed to deceive visitors into entering sensitive account credentials, payment details, or personal information under the pretense of a legitimate cryptocurrency payment service. The impersonation of a trusted financial brand increases the likelihood of successful exploitation, particularly among users familiar with Binance’s offerings.

Analysis indicates the domain was registered on February 21, 2026, through NameCheap, Inc., and resolves to the IP address 199.192.23.85, hosted on AS22612 (Namecheap, Inc.) in the United States. The infrastructure lacks an SSL certificate, further reducing its legitimacy. Detection metrics reveal the domain is flagged by 18 out of 95 security vendors on VirusTotal and appears on one security blocklist. Additionally, the domain has been classified as offline, suggesting mitigation efforts or voluntary takedown by the registrar.

Users who accessed card.invierteseguro.lat should immediately revoke any entered credentials, particularly those associated with Binance or linked financial accounts. Monitor all connected accounts for unauthorized transactions or logins, and enable multi-factor authentication where available. If payment details were submitted, contact the relevant financial institution to initiate fraud protection protocols. Security teams are advised to update blocklists with the domain and associated IP address to prevent further exposure.