bergkroneinvexa[.]net

The domain bergkroneinvexa.net was registered on February 21, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the Cloudflare address 172.67.182.177, which is associated with AS13335 Cloudflare, Inc., located in the United States. The domain is configured with Cloudflare authoritative nameservers aitana.ns.cloudflare.com and duke.ns.cloudflare.com, but no SSL/TLS certificate is presented for the host, indicating that HTTPS is not enabled. The site’s page title, captured before the domain was taken offline, reads "Bergkrone Invexa™: Offizielles KI-Trading in Deutschland | Geprüft & Vertrauenswürdig," suggesting an attempt to present a German‑language investment or trading service. The threat classification is brand impersonation, specifically targeting the cryptocurrency exchange Binance, as indicated by the intelligence that the domain impersonates Binance.

VirusTotal analysis shows that two of ninety‑five scanning engines flagged the domain, and the domain appears on a single security blocklist, with PhishDestroy already listing it as blocked. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The current status is offline, so active content cannot be inspected, and no SSL certificate further limits the ability to establish a secure connection.

Defenders should continue to block the IP address 172.67.182.177 and the domain itself at network perimeter devices, add the domain to threat intelligence feeds, and monitor for newly registered domains that resolve to the same Cloudflare IP range and use similar German‑language branding. Because the page title references KI‑Trading, any future re‑appearance of the domain should be scrutinized for potential credential‑harvesting forms that mimic Binance login flows. Continuous observation of Cloudflare‑hosted domains with low trust scores and minimal vendor detections is recommended to pre‑empt re‑use of this infrastructure for further brand‑impersonation campaigns.