narixo-delu[.]de

Analysis of the domain narixo-delu.de indicates it is a confirmed brand impersonation scam targeting Binance users, currently offline as of July 25, 2026. The domain was registered on February 21, 2026, and resolved to the IP address 188.114.96.3, hosted on Cloudflare's infrastructure (AS13335) in the United States. Security vendors have flagged this domain, with 14 out of 93 detection engines on VirusTotal classifying it as malicious. It appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its fraudulent nature.

The page title, 'Narixo Delu™ - KI-Trading Deutschland 2026,' suggests an attempt to deceive German-speaking users by mimicking Binance’s branding while promoting AI-driven trading services. The domain uses Cloudflare nameservers (charles.ns.cloudflare.com and jacqueline.ns.cloudflare.com) and employs security technologies such as HSTS and HTTP/3, which are commonly used by legitimate sites but also leveraged by threat actors to evade detection. The SSL certificate is issued by Google Trust Services (WE1), which does not inherently indicate malicious intent but is consistent with domains seeking to appear trustworthy. Gridinsoft’s trust score of 0/100 further corroborates the domain’s fraudulent classification.

While the exact content and mechanics of the scam are not fully analyzed due to its offline status, the available evidence—including detection by multiple security vendors, blocklist inclusion, and the explicit impersonation of Binance—confirms its high-risk designation. Defenders should treat this domain as malicious, block it at the network level, and monitor for related infrastructure or newly registered lookalike domains. Users who may have interacted with this site should verify their accounts for unauthorized activity and report the domain to relevant financial and cybersecurity authorities.