novyrakelthar-invest[.]com

This domain, novyrakelthar-invest.com, poses a brand impersonation phishing threat specifically targeting users of the cryptocurrency exchange Binance. The site presents itself as an official platform offering AI-driven trading services, complete with fabricated user reviews such as "Über 10.000 Bewertungen" to create a false sense of legitimacy. Its primary objective is to deceive visitors into disclosing login credentials, depositing funds, or downloading malicious software under the guise of a trusted service. The use of Binance’s branding, combined with urgency-driven claims like "KI-Trading 2025," is designed to exploit user trust and prompt hasty actions without verification. Analysis indicates this domain was registered on October 15, 2025, through GRANSY S.R.O D/B/A SUBREG.CZ, a registrar frequently associated with malicious infrastructure. It resolves to the IP address 172.67.220.138, hosted on Cloudflare’s network (AS13335), which is commonly leveraged to obscure the true origin of phishing sites. At the time of detection, 12 out of 95 security vendors on VirusTotal flagged the domain as malicious, and it appeared on one security blocklist. Notably, the domain lacks an SSL certificate, a red flag for users accustomed to encrypted connections on legitimate financial platforms. The page title, "NovyraKelthar - Offizielle Plattform | KI-Trading 2025," further reinforces the impersonation by mimicking the language and structure of official Binance communications. If you visited novyrakelthar-invest.com or interacted with its content, immediate action is required to mitigate potential compromise. First, revoke any active sessions on Binance or other cryptocurrency platforms and change passwords using a secure, unrelated device. Enable multi-factor authentication (MFA) if not already active, and monitor accounts for unauthorized transactions or login attempts. If financial information or cryptocurrency was shared, report the incident to the targeted platform and relevant authorities, such as local cybercrime units or financial regulators. Additionally, scan the device used to access the site for malware, as phishing pages often deploy malicious payloads. Users should also verify the legitimacy of any communications claiming to be from Binance by cross-referencing with official channels, such as the company’s verified website or support portal.