drazelionix-ki[.]de

The domain drazelionix-ki.de was registered on March 12, 2026 and is currently listed as offline. Technical profiling shows the site was hosted behind Cloudflare (ASN13335) with the public IP address 104.21.95.164 located in the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 label, and the site advertised HSTS, Cloudflare Browser Insights, and HTTP/3 support. Nameserver records point to clarissa.ns.cloudflare.com and rick.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure.

The page title returned from the host is "Drazelionix™ - KI-Trading Deutschland 2026," which does not reference the targeted brand but the intelligence set classifies the activity as a brand‑impersonation campaign targeting Binance. VirusTotal scans show a single positive detection out of 94 security vendors, indicating at least one vendor flagged the domain for malicious behavior. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on three independent security blocklists. Additional blocklist providers—PhishDestroy, MetaMask, and SEAL—have explicitly blocked the domain, reinforcing the assessment of malicious intent.

The evidence suggests the operator leveraged a reputable CDN to obscure origin, employed a valid SSL certificate to increase user trust, and crafted a title that mimics a legitimate German AI‑trading service, while the underlying motive is to deceive Binance users. Uncertainty remains regarding the exact phishing payload or credential‑stealing mechanisms because the site content has not been captured; only infrastructure and metadata are available. Defenders should add the domain and its associated IP address to deny‑list rules, monitor for any re‑use of the IP or similar Cloudflare‑hosted subdomains, and continue to track related indicators on blocklist feeds.