findorex-ai[.]de

Analysis of the domain findorex-ai.de indicates an active phishing campaign targeting users of artificial intelligence-based trading platforms. The domain was registered on February 21, 2026, and currently resolves to the IP address 188.114.97.3, which is part of AS13335 (Cloudflare, Inc.) located in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (lilith.ns.cloudflare.com and memphis.ns.cloudflare.com) and HTTP/3 technology, alongside a valid SSL certificate issued by Google Trust Services (WE1). The page title, 'Findorex – Vertrauenswürdige KI-Handelsplattform,' explicitly presents the site as a trustworthy AI trading platform, suggesting an intent to deceive users seeking automated financial services. The domain is flagged by multiple security mechanisms, including PhishDestroy, MetaMask, and SEAL, and is listed on three security blocklists. Google Safe Browsing classifies the domain under 'SOCIAL_ENGINEERING,' further corroborating its malicious nature. As of July 12, 2026, nine out of ninety-three security vendors on VirusTotal have detected the domain as malicious. The site remains operational, returning an HTTP 301 status code, which may indicate a redirect to another malicious endpoint or an attempt to evade detection. While the exact content and functionality of the site have not been fully analyzed, the combination of infrastructure, detection data, and page title strongly suggests a phishing operation aimed at harvesting credentials or financial information. Defenders should prioritize blocking the domain and its associated IP address (188.114.97.3) at the network level. Monitoring for related domains registered under similar naming conventions or infrastructure patterns is recommended to mitigate further risk.