raspoarsap[.]click

This domain is flagged as an elevated-risk brand impersonation threat targeting Binance, a major cryptocurrency exchange. The site mimics Binance’s Turkish login portal, as evidenced by the page title 'Giriş Yap | Binance TR,' designed to harvest user credentials for unauthorized account access or financial theft. Analysis indicates a deliberate attempt to exploit trust in the Binance brand, particularly among Turkish-speaking users. Infrastructure analysis reveals the domain was registered on October 11, 2025, through Dynadot LLC and resolves to the IP address 78.159.156.48, hosted in the Netherlands under AS25211 (Euro Crypt EOOD). The domain lacks an SSL certificate, increasing the risk of interception during credential submission. It appears on one security blocklist and is flagged by 18 out of 95 security vendors on VirusTotal, confirming its malicious classification. The absence of legitimate branding elements and the use of a recently registered domain further support its fraudulent nature. Mitigation steps for this credential theft threat include immediate blocking of the domain and its associated IP (78.159.156.48) at the network level. Organizations should update endpoint protection rules to detect and prevent access to the domain. Users who may have interacted with the site should be instructed to reset their Binance credentials via the official platform and enable multi-factor authentication. Security teams should monitor for unauthorized login attempts or transactions linked to compromised accounts, particularly those originating from Turkish-language regions.