crestway-talyx[.]net

The domain crestway-talyx.net was registered on 21 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. DNS resolution points to the IP address 172.67.212.221, which is announced by AS13335 Cloudflare, Inc. and geolocated to the United States. The domain is served by the Cloudflare nameservers kobe.ns.cloudflare.com and serena.ns.cloudflare.com, but no TLS certificate is presented, indicating that HTTPS is not enabled for the site. Google Safe Browsing classifies the site as a social engineering threat, and three independent security blocklists have listed the domain. VirusTotal analysis shows that 11 out of 93 scanning engines flagged the domain, indicating a moderate level of detection across the security community.

Additional blocking by PhishDestroy, MetaMask, and SEAL confirms that the site is recognized as malicious by specialized anti‑phishing tools. The page title observed during the brief crawl reads “Crestway Talyx™ - KI‑Trading Deutschland 2026”, and the campaign is explicitly targeting the Binance brand, as indicated by the declared brand target. Gridinsoft assigns a trust score of 0 out of 100, reflecting extreme lack of credibility. At the time of reporting (24 July 2026) the site is reported offline, which may be the result of takedown actions or temporary suspension.

However, the infrastructure indicators—including the recent registration, Cloudflare hosting, and the absence of TLS—remain useful for correlation with future observations. Defenders should add crestway‑talyx.net to deny‑list rules, monitor the associated Cloudflare IP range for similar newly created domains, and enforce strict verification of any communications purporting to originate from Binance. Network‑level controls that block traffic to the identified IP address and its ASN can further reduce exposure. Continuous re‑query of public threat‑intel feeds is recommended to detect any re‑deployment of the same branding or hosting configuration.