marass[.]click

The domain marass.click is a phishing site engaged in brand impersonation targeting Binance, a major cryptocurrency exchange. It presents itself as a legitimate login portal for Binance TR, tricking users into entering credentials under the guise of accessing their accounts. As of the latest verification, marass.click has been taken offline, but it previously posed an elevated risk of credential theft without deploying a crypto drainer kit.

Technical indicators confirm the malicious nature of marass.click. The domain was flagged by 17 of 95 security vendors on VirusTotal, including ADMINUSLabs, alphaMountain.ai, and Bfore.Ai PreCrime. It appears on 2 security blocklists, PhishDestroy and PhishingDB, and was registered through Dynadot LLC on October 24, 2025. The domain resolved to the IP address 78.159.156.48, hosted on AS25211 Euro Crypt EOOD in the Netherlands, with nameservers ns1.dyna-ns.net and ns2.dyna-ns.net. No SSL certificate was issued, and the observed page title was 'Giriş Yap | Binance TR'. AlienVault OTX recorded the domain in 16 threat intelligence pulses.

Users who interacted with marass.click should immediately change their Binance account passwords and enable two-factor authentication (2FA) to prevent unauthorized access. Monitor account activity for signs of fraud, such as unauthorized transactions or login attempts. Report the phishing domain to Binance’s official abuse channels and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in broader mitigation efforts.