klarnium[.]net

Analysis of the domain klarnium.net, created on 21 February 2026 and currently listed as offline, shows multiple indicators of a brand‑impersonation campaign targeting Binance. The site resolves to the Cloudflare address 172.67.184.5, which is announced as belonging to AS13335 Cloudflare, Inc., United States. DNS resolution uses the Cloudflare nameservers hassan.ns.cloudflare.com and jewel.ns.cloudflare.com, confirming that the infrastructure is hosted behind Cloudflare’s edge network. An SSL certificate issued by Google Trust Services (WE1) is present, but the HTTP response returns status code 403, preventing content retrieval at the time of analysis. The page title recorded in the intelligence feed – “Klarnium Erfahrungen | KI‑Trading | Hohes Kapital sichern” – is unrelated to Binance but the intelligence explicitly marks the domain as impersonating the Binance brand.

VirusTotal has recorded four detections out of ninety‑five scanning engines, indicating that a minority of security products have flagged the host as malicious. The domain appears on a single public blocklist and has been blocked by the PhishDestroy service. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. Registrar information shows the domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com, a known registrar often used for disposable or malicious registrations. No additional technology fingerprints beyond the Cloudflare service were observed.

Given the combination of a recent registration, Cloudflare‑based hosting, a mismatched page title, low trust score, and multiple vendor detections, the evidence supports a confirmed brand‑impersonation threat. The offline status suggests the site may be intermittently activated or has been taken down, but the underlying infrastructure remains under the same IP and nameserver configuration. Defenders should block klarnium.net at the DNS and proxy layers, add the address 172.67.184.