allocation-sperax[.]com

This domain, allocation-sperax.com, is actively impersonating Binance as part of a high-risk phishing operation. Registered on August 23, 2025, through Tucows Domains Inc., the site resolves to IP address 104.21.92.204 and is flagged by 3 of 95 security vendors in aggregated scans. Infrastructure analysis reveals the use of a known phishing kit associated with Wallet Connect abuse, a technique commonly exploited to facilitate cryptocurrency theft by tricking users into connecting wallets to malicious smart contracts. The domain is currently listed on two security blocklists, including PhishDestroy and BLP-Malware, and has been referenced in 23 threat intelligence pulses, indicating widespread detection across multiple security communities. The site presents itself as an 'Official Page,' a clear indicator of brand impersonation targeting Binance users. It employs Google Web Server technology and enforces HSTS and HTTP/3 protocols, which may be leveraged to enhance perceived legitimacy. The SSL certificate is issued by Google Trust Services, a common tactic to evade basic security warnings. Despite these technical measures, the domain holds a Gridinsoft trust score of 0/100, reinforcing its malicious classification. Defenders should treat this domain as an active threat. Immediate action includes blocking the domain and its resolving IP at the network perimeter, as well as monitoring for any Wallet Connect-related activity originating from internal systems. Given the domain’s persistence and the specificity of the phishing kit, it is likely part of a broader campaign targeting cryptocurrency users. No evidence suggests takedown efforts have been successful as of July 12, 2026, and the site remains operational. Further analysis of the phishing kit’s behavior is recommended to identify additional indicators of compromise.