seguro-binance[.]app

The domain seguro-binance.app was registered on February 25, 2026 through OwnRegistrar, Inc. and immediately began serving a page whose HTML title is “Checking if you are human”. The site appears on three public security blocklists and is actively blocked by PhishDestroy, MetaMask and SEAL. VirusTotal scans show that five of ninety‑three anti‑virus engines flagged the domain, indicating a moderate detection rate consistent with known crypto‑scam infrastructure. Infrastructure analysis reveals that the domain resolves to the IP address 188.114.96.3, which belongs to the Cloudflare network (AS13335) and is geolocated to the United States.

The authoritative nameservers are garrett.ns.cloudflare.com and grannbo.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. No TLS certificate is presented, meaning the site is reachable only over HTTP, which further reduces confidence in its legitimacy. The domain is classified as a “Crypto Scam” that impersonates the Binance brand, and its page title suggests a possible human‑verification step, a common technique to filter automated traffic. The current operational status is reported as offline, but the presence on multiple blocklists and the detection by several security vendors suggest that the infrastructure may be re‑used for future campaigns.

Defenders should add the domain and its resolving IP to deny‑list rules, monitor the associated Cloudflare nameservers for any new sub‑domains, and ensure that endpoint protection solutions are updated to reflect the five vendor detections. Continuous observation of blocklist feeds and VirusTotal is recommended to capture any re‑activation attempts. Because the site lacks an SSL certificate and no further page content has been captured, analysts cannot confirm additional payloads or credential‑stealing mechanisms, and the exact phishing flow remains uncertain.