nevelano-bot[.]com

On 21 February 2026 the domain nevelano-bot.com was registered through Name SRS AB. The domain resolves to the Cloudflare address 172.67.217.230, which belongs to ASN 13335 and is geolocated to the United States. The authoritative name servers are elsa.ns.cloudflare.com and weston.ns.cloudflare.com. No TLS certificate is presented, indicating the site was served without HTTPS. The page title observed during the brief crawl reads “NevelanoBot - Offizielle Plattform | KI‑Trading 2025 | Über 10.000 Bewertungen”, and the intelligence profile classifies the operation as a Binance brand impersonation. The site has been taken offline, and the PhishDestroy blocklist records it as inactive. VirusTotal scanned the domain and 4 of 93 security vendors returned a positive detection, confirming malicious intent. AlienVault OTX lists the domain in a single threat pulse, and it appears on one additional security blocklist. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the classification as malicious.

Analysis indicates that the infrastructure relies on Cloudflare’s public network, a common choice for fast‑hosting phishing pages, and that the lack of a valid SSL certificate suggests a temporary deployment. The limited detection footprint—four vendor flags, a single OTX pulse, and one blocklist entry—implies that the campaign had a short lifespan or limited distribution. Uncertainties remain regarding the exact content served, the presence of credential‑harvesting forms, and any additional command‑and‑control endpoints, because the site was offline before a full content capture could be performed.

Defenders should proactively block nevelano-bot.com at perimeter firewalls and DNS filtering solutions, add the IP 172.67.217.230 to any cloud‑service blocklists, and monitor for newly created domains that resolve to the same Cloudflare ASN and use similar naming patterns.