airally[.]co

This domain, airally.co, was identified as a credential harvesting site targeting users of the Binance cryptocurrency exchange. The site masqueraded as a legitimate Binance service, likely prompting visitors to enter sensitive account details such as usernames, passwords, and two-factor authentication codes. Once captured, these credentials could be used to gain unauthorized access to victims' cryptocurrency wallets, leading to financial theft and account compromise. The site's infrastructure and design were specifically tailored to exploit trust in the Binance brand, making it particularly dangerous for users unfamiliar with phishing tactics. Analysis indicates that airally.co was registered on December 22, 2025, through Web Commerce Communications Limited, a registrar often associated with malicious domain registrations. The domain resolved to the IP address 172.67.199.242 and was flagged by 4 out of 95 security vendors on VirusTotal, a relatively low but notable detection rate that suggests evasion techniques were employed. Additionally, the domain appeared on three security blocklists, including those maintained by MetaMask and SEAL, further confirming its malicious intent. The page title, AiRally, was likely chosen to mimic a legitimate service while avoiding immediate suspicion. If you visited airally.co or entered any credentials on the site, immediate action is required to mitigate potential damage. First, revoke access to any cryptocurrency wallets or exchange accounts linked to the credentials provided. Enable two-factor authentication if not already active, and monitor all connected accounts for unauthorized transactions. Consider transferring funds to a new wallet if compromise is suspected. Report the incident to Binance's official security team and any relevant financial authorities. Users should also scan their devices for malware, as phishing sites may distribute additional malicious payloads. Finally, remain vigilant for follow-up phishing attempts via email or social engineering, as attackers may reuse harvested data for further exploitation.