vortexcryptoai[.]net

Analysis of the domain vortexcryptoai.net indicates a confirmed phishing campaign impersonating Binance, a cryptocurrency exchange platform. The domain was registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with suspicious domains. Infrastructure analysis reveals the domain resolves to IP address 172.67.135.1, hosted on Cloudflare's network (AS13335) in the United States. No SSL certificate was detected at the time of assessment, increasing the risk of unencrypted data interception.

The domain is flagged by three security blocklists, including PhishDestroy, MetaMask, and SEAL, confirming its malicious classification. Gridinsoft assigns a trust score of 0/100, further corroborating its fraudulent nature. While VirusTotal reports three detections out of 93 security vendors, this partial coverage suggests the threat is recognized but not yet universally blocked. The page title, 'Vortex Crypto AI - Oficiální platforma | AI-Trading 2025 | Více než 10 000 hodnocení,' explicitly references AI-driven trading and official branding, aligning with tactics used to deceive users into believing the site is a legitimate Binance-affiliated platform.

Nameservers ivan.ns.cloudflare.com and lilyana.ns.cloudflare.com indicate reliance on Cloudflare's DNS infrastructure, a common obfuscation technique to evade takedowns. As of July 22, 2026, the domain is offline, though its prior activity and registration details remain relevant for historical threat intelligence. Defenders should treat this domain as a high-risk indicator and prioritize blocking it at the DNS and network levels. Additional monitoring of domains registered through the same registrar or resolving to the identified IP range is recommended to identify potential related threats.