ziffermarkpro[.]com

ziffermarkpro.com was registered on 21 February 2026 through Name SRS AB and is currently offline. The site presented the page title “Ziffermark Pro™: Offizielles KI‑Trading in Deutschland | Geprüft & Vertrauenswürdig”, which explicitly references a German‑language trading service and attempts to convey legitimacy. The domain is listed as a brand‑impersonation campaign targeting Binance, as indicated by the supplied intelligence. Technical resolution shows the domain pointing to IP address 104.21.75.131, which belongs to Cloudflare (AS13335) and is located in the United States. The authoritative nameservers are etienne.ns.cloudflare.com and keira.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure.

No TLS certificate was observed, meaning the site was served over plain HTTP, which is atypical for legitimate financial services and further supports the malicious classification. VirusTotal analysis recorded detections from two of ninety‑three security vendors, providing independent confirmation of malicious behavior. The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy service. Independent trust scoring from Gridinsoft assigned a score of 0 out of 100, indicating a high confidence of abuse. The lack of an SSL certificate, low trust score, and presence on blocklists collectively reinforce the assessment that the domain was being used for fraudulent Binance impersonation.

Uncertainties remain regarding the exact content that was served before the site was taken offline; the page title is the only visible artifact, and no further samples of HTML, login forms, or payloads have been captured. Consequently, defenders cannot confirm the specific phishing workflow or any credential‑stealing mechanisms that may have been employed. Defensive recommendations include adding 104.21.75.131 to network blocklists, enforcing DNS filtering for ziffermarkpro.