marvalk[.]click

Analysis of marvalk.click, observed on July 23 2026, indicates that the domain is being used for a brand‑impersonation campaign targeting Binance users. The site presented the page title “Giriş Yap | Binance TR”, which aligns with a Turkish‑language login prompt and matches the declared scam type of a crypto scam. Registration data show the domain was created on 10 October 2025 through Dynadot LLC, and the authoritative nameservers are ns1.dyna‑ns.net and ns2.dyna‑ns.net. DNS resolution points to the IPv4 address 78.159.156.48, which is allocated to AS25211 Euro Crypt EOOD in the Netherlands. No TLS certificate is served, meaning the site was reachable only over HTTP, and the Gridinsoft trust score for the domain is 0 out of 100, indicating an extremely low reputation.

Threat‑intel feeds corroborate malicious activity: the domain appears in one external security blocklist and is actively blocked by PhishDestroy. AlienVault OTX references the domain in 17 separate pulses, demonstrating repeated observation by the community. VirusTotal scanned the domain with 95 antivirus engines, of which 15 flagged it as malicious, reinforcing the suspicion of abuse. The lack of a valid SSL certificate, combined with the low trust score and the presence on blocklists, suggests the infrastructure is intentionally low‑profile and possibly short‑lived. Uncertainty remains regarding the current operational status of the site; the domain is reported as offline at the time of this assessment, and no live HTTP response can be verified.

Consequently, the full payload, any embedded URLs, or credential‑harvesting mechanisms cannot be examined. Defenders should continue to monitor the IP address 78.159.156.48 for any re‑activation, enforce outbound filtering for the domain and its associated nameservers, and ensure that security solutions ingest the OTX indicators and the VirusTotal detection count. Adding marvalk.