revaloninvest-ki[.]de

revaloninvest-ki.de is a newly registered domain (created 21 Feb 2026) that masquerades as Binance. The site presented the title “RevalonInvest™ - KI‑Trading Deutschland 2026”, indicating an investment‑focused lure. No TLS certificate was observed, leaving the HTTP connection unencrypted. The domain resolves to 188.114.97.3, an address owned by Cloudflare (AS13335) located in the United States. Nameserver records point to ashton.ns.cloudflare.com and roxy.ns.cloudflare.com, confirming Cloudflare hosting.

Reputation scoring is extremely low; Gridinsoft assigned a trust score of 0 / 100. VirusTotal analysis shows 15 of 93 antivirus engines flag the domain as malicious, reinforcing the suspicion. The domain appears on three public security blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL. The indicated scam type is an investment scam, targeting users of the Binance platform. As of the report date (23 Jul 2026) the site is taken offline, but the infrastructure—especially the Cloudflare‑hosted IP—remains reusable for future campaigns.

Defenders should continue to monitor the IP 188.114.97.3 and associated Cloudflare nameservers for re‑use, incorporate the domain into URL filtering and threat‑intel feeds, and enforce strict TLS inspection policies to detect any future unencrypted impersonation attempts. Network sensors should flag any outbound connections to this IP, and endpoint protection should apply the VirusTotal detections and Gridinsoft score as indicators of compromise. Because the site is currently inactive, no immediate payload analysis is possible, but the presence of the brand name Binance in the title and the investment‑scam narrative suggests that future iterations may employ credential‑harvesting pages. Organizations using Binance services should educate users about unsolicited investment offers and encourage verification of URLs before entering credentials.