skickligfinvoro[.]net

Analysis of skickligfinvoro.net shows a brand-impersonation campaign targeting Binance users. The domain was registered on 21 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is hosted on Cloudflare's network (ASN 13335) with the IP address 104.21.91.119, which resolves to the United States. The authoritative nameservers are jack.ns.cloudflare.com and jasmine.ns.cloudflare.com. No TLS certificate is presented, indicating the site was delivered over plain HTTP when it was online. The page title observed during the brief crawl reads "Skicklig Finvoro™ - AI-Trading Sverige 2025", which references a Swedish-language AI-trading service but does not contain any visible Binance branding.

The site explicitly impersonates Binance according to the supplied intelligence, and the risk level is marked as elevated. Reputation checks show a Gridinsoft trust score of 0/100 and the domain appears on three security blocklists. VirusTotal scans reported nine detections out of ninety-three scanners, and the domain is currently listed as blocked by PhishDestroy, MetaMask, and SEAL. The site’s status is offline at the time of reporting, and no SSL certificate is available for verification. Defenders should immediately block traffic to skickligfinvoro.net and to its associated IP address 104.21.91.119.

Adding the domain to internal URL filtering, DNS sinkholing, and endpoint protection lists will prevent inadvertent user access. Continuous monitoring of Cloudflare-hosted IP ranges for new domains registered with similar naming patterns or the same registrar is advised, as threat actors often reuse the same infrastructure. Because the page content beyond the title has not been captured, further investigation should be conducted if the domain resurfaces, focusing on login-page mimicry and credential-stealing mechanisms. Maintaining awareness of the listed blocklists and updating detection rules accordingly will reduce exposure to this brand-impersonation campaign.