sichenta[.]net

Analysis of the domain sichenta.net shows that it was registered on 2 December 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently marked as taken offline. The authoritative nameservers are ns1.suspended-domain.com and ns2.suspended-domain.com, and DNS resolution points to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate is presented, indicating the site does not serve HTTPS traffic. The public page title recorded during the brief observation reads “Sichenta™ – KI‑Trading Deutschland 2025”, which does not reference the targeted brand, but the intelligence tags the activity as a Binance brand impersonation campaign.

VirusTotal scans have returned 15 positive detections out of 95 security vendors, and the domain is listed on three external blocklists. Additional defensive products such as PhishDestroy, MetaMask, and SEAL have already blocked the domain. AlienVault OTX references the domain in a single threat‑intel pulse, and Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. Given the combination of a recent registration date, the use of a generic‑sounding name, a Cloudflare‑hosted IP, lack of TLS, and multiple vendor detections, the infrastructure is consistent with a high‑confidence impersonation operation aimed at Binance users.

Defenders should immediately add sichenta.net and its resolving IP 188.114.97.3 to network‑level deny lists and to any URL filtering solutions. Monitoring of the registrar PublicDomainRegistry.com for further abusive registrations is advised, as is periodic re‑query of the domain’s DNS records in case the site is re‑activated. Because the site is offline, dynamic analysis of payloads is not possible, but the existing detection signals justify proactive blocking and user‑awareness messaging that references the Binance brand impersonation attempt.