linzex-oro[.]de

The domain linzex-oro.de was registered on 2026-02-21 and is currently taken offline. It resolves to the Cloudflare IP address 104.21.56.169, which belongs to ASN 13335 (Cloudflare, Inc.) and is geolocated to the United States. The site presents the page title "Lin Zex Oro™ - KI-Trading Deutschland 2026" and lacks an SSL certificate, indicating an unencrypted HTTP service at the time of observation. Both authoritative nameservers, leland.ns.cloudflare.com and olivia.ns.cloudflare.com, are hosted by Cloudflare, suggesting the attacker leveraged the provider's CDN for anonymity.

The domain received a Gridinsoft trust score of 0 out of 100, reflecting extreme risk. Google Safe Browsing flagged the site for social engineering, and it is listed on three security blocklists. Independent detection services have identified the domain as malicious: 13 of 95 vendors on VirusTotal flagged it, and it is actively blocked by PhishDestroy, MetaMask, and SEAL. The threat is classified as a brand impersonation targeting Binance, with the page title and scam type explicitly indicating an attempt to deceive users into believing the site is affiliated with a legitimate KI‑trading service.

No HTTPS certificate was observed, and no further content analysis is available because the site is offline. Defenders should continue to block the domain at network perimeters, update URL filtering lists, and monitor for any re‑registration or infrastructure changes. Analysts should also watch for related domains that reuse the same Cloudflare IP range or nameserver patterns, as these may indicate a broader campaign. Until the site is taken down permanently, continued vigilance is recommended.