ziloger-karmexi[.]net

This domain, ziloger-karmexi.net, is identified as a high-risk generic_phishing operation impersonating the KI-Trading brand under the fabricated name 'Ziloger Karmexi™.' The page title explicitly references 'KI-Trading Deutschland 2026,' suggesting a targeted campaign against German-speaking users involved in algorithmic or AI-based trading platforms. No known drainer kit signatures were detected in initial scans, but the domain exhibits characteristics consistent with credential harvesting or fraudulent investment schemes. Analysis indicates the domain was registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.) in the United States, with no SSL certificate present. VirusTotal reports 18 out of 95 security vendors flagging the domain, while Google Safe Browsing classifies it as phishing. The domain appears on three security blocklists and is actively blocked by at least three independent threat intelligence feeds. As of the latest verification, ziloger-karmexi.net has been taken offline, likely due to enforcement actions by hosting providers or registrars. However, the infrastructure remains a residual risk, particularly if the threat actors re-deploy the campaign under a newly registered domain or IP. Users who interacted with this domain should assume credential exposure and monitor for unauthorized access to financial or trading accounts. Organizations are advised to update blocklists with the provided indicators and conduct retrospective log analysis for connections to 188.114.96.3 or related domains registered via the same registrar.