krozaxfin[.]com

On 24 July 2026, the domain krozaxfin.com was observed hosting a site whose title reads “KrozaxFin | Offizielle Website‑Plattform”. The domain was registered on 28 February 2026 through Hosting Concepts B.V. d/b/a Registrar.eu and is delegated to the nameservers ina1.registrar.eu, ina2.registrar.eu, and ina3.registrar.eu. DNS resolution points to IP address 104.21.39.34, which belongs to Cloudflare, Inc. (AS13335) and is geolocated to the United States. No TLS certificate is presented; the server responds with HTTP status 200 over plain HTTP.

Reputation services list the domain on three security blocklists and record three positive detections out of ninety‑three vendors on VirusTotal. Additional blocking is reported from PhishDestroy, MetaMask, and SEAL. Independent scoring from Gridinsoft assigns a trust rating of 0 / 100, indicating a lack of confidence in the site’s legitimacy. The site is classified as a brand‑impersonation campaign targeting Binance, although the page content has not been publicly examined beyond the title.

The available evidence confirms active infrastructure, a recent registration, and multiple security vendor flags, suggesting the domain is being used for malicious purposes. Uncertainty remains regarding the specific phishing payload, credential‑capture mechanisms, or any additional infrastructure such as command‑and‑control servers, because the site content has not been dissected. Defenders should continue to block the domain at network perimeter and DNS layers, monitor outbound connections to the associated Cloudflare IP, and add the domain and its IP to internal blocklists. Continuous re‑scanning with multi‑engine services is advised to capture any future changes in detection status, and any observed credential submission should be reported to the Binance abuse channel.