vexilo-naren[.]com

The domain vexilo-naren.com was registered on February 21, 2026 through REALTIME REGISTER B.V. and is currently taken offline. DNS resolution points to IP address 104.21.76.126, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. Both authoritative nameservers, charles.ns.cloudflare.com and jacqueline.ns.cloudflare.com, are Cloudflare‑operated, indicating the site leveraged the provider's CDN and DDoS mitigation services. No SSL certificate is presented for the domain, suggesting that HTTPS was either not configured or was removed prior to takedown.

The page title observed during the brief window of activity was "Vexilo Naren™ - KI‑Trading Deutschland 2026," a title that does not reference the targeted brand but is consistent with a fraudulent front‑end. The threat classification is brand impersonation, specifically targeting the cryptocurrency exchange Binance, as indicated by the intelligence tag "Impersonates: binance" and the declared scam type. Reputation scoring is extremely low, with Gridinsoft assigning a trust score of 0 out of 100. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, and VirusTotal recorded 12 positive detections out of 95 scanners, reinforcing the malicious assessment.

Despite the offline status, the infrastructure—Cloudflare edge IP, lack of TLS, and the use of a generic registrar—mirrors common patterns employed by actors seeking to host phishing or credential‑harvesting pages. Defenders should immediately add vexilo-naren.com to URL filtering and DNS blocklists, monitor the associated Cloudflare IP for any resurgence of malicious content, and extend brand protection measures for Binance to capture similar impersonation attempts. Continuous observation of newly registered domains using the same registrar or nameserver pattern is recommended to pre‑empt future campaigns.