# marzban.novavpn.org — SUSPICIOUS

> Learn about marzban.novavpn.org, a low-risk phishing domain now offline. Stay informed and protect yourself from potential threats.

## Summary
PhishDestroy has identified marzban.novavpn.org as a generic phishing domain with a low risk level. The domain was flagged for suspicious activity related to credential harvesting attempts, though it did not pose a high threat based on current intelligence. Users should remain cautious when encountering similar domain patterns.

The domain marzban.novavpn.org was registered on March 11, 2026, through Ultahost, Inc., and resolved to the IP address 192.142.45.116. It appeared on one security blocklist and was detected by one out of 95 security vendors on VirusTotal, indicating limited but notable suspicion. The domain's page title matched the domain name, which is common in phishing setups to create a facade of legitimacy.

Currently, marzban.novavpn.org is offline, reducing immediate risk to users. PhishDestroy recommends continued monitoring of related domains and advises users to avoid interacting with suspicious VPN-related domains. Maintaining updated security software and awareness of phishing tactics remains essential for protection against emerging threats.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: dead (HTTP 0)
- Page title: marzban.novavpn.org

## Domain Intelligence
- Registered: 2026-03-11 03:07:02
- Registrar: Ultahost, Inc.
- Country: RU
- IP: 192.142.45.116
- IP Country: NL
- IP City: Amsterdam
- IP Org: AS214036 Ultahost, Inc.
- Nameservers: ns1.ultahost.com ns2.ultahost.com ns3.ultahost.com ns4.ultahost.com
- SSL Issuer: none

## Detection Status
- VirusTotal: 1 vendors flagged
  Vendors: ["SOCRadar"]
- Google Safe Browsing: clean
- Blocklists: 1 hits
  Lists: ["PhishDestroy"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019cdaa0-6716-747f-97f0-8560817c29c5.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/833a28d5-e3cf-4332-ad18-84762cf38834
- PhishDestroy: https://phishdestroy.io/domain/marzban.novavpn.org/
- LLM endpoint: https://phishdestroy.io/domain/marzban.novavpn.org/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/marzban.novavpn.org/
Last updated: 2026-03-19