klarnium[.]pro

Analysis of the domain klarnium.pro indicates it is a brand-impersonation scam targeting Binance users, currently offline but previously active. The domain was registered on February 21, 2026, through NameCheap, Inc., and uses Cloudflare nameservers (doug.ns.cloudflare.com and shubhi.ns.cloudflare.com). Infrastructure analysis reveals it resolves to the IP address 104.21.83.189, hosted on Cloudflare's network (AS13335) in the United States. The SSL certificate is issued by Google Trust Services (WE1), a common choice for both legitimate and malicious sites leveraging Cloudflare's services.

The page title, 'Klarnium Erfahrungen | KI-Trading | Hohes Kapital sichern,' suggests the site posed as a German-language AI-driven trading platform, likely designed to deceive users into believing it was affiliated with Binance or offered high-yield investment opportunities. While the domain is currently offline and returns an HTTP 403 status, it was flagged by 4 of 93 security vendors on VirusTotal, indicating prior detection as malicious. It also appears on at least one security blocklist, specifically PhishDestroy, further corroborating its fraudulent nature. Defenders should treat this domain as high-risk for brand impersonation, particularly for users searching for Binance-related services or AI trading platforms.

The use of Cloudflare infrastructure is notable, as it obscures the true hosting origin and complicates takedown efforts. Although the site is offline, the registration date and prior detections suggest it may have been part of a broader campaign. Security teams are advised to monitor for re-emergence under the same or similar domains, particularly those using Cloudflare nameservers or targeting cryptocurrency users. No evidence of a phishing kit or specific payload is available, but the page title and brand target strongly imply an investment scam or credential-harvesting operation.