tradevornax-365[.]de

Analysis of the domain tradevornax-365.de confirms its classification as a high-risk phishing site targeting Binance users. The domain was registered on March 3, 2026, and resolved to the IP address 104.21.55.182, hosted on Cloudflare's infrastructure (AS13335). Nameservers cruz.ns.cloudflare.com and peter.ns.cloudflare.com further link the domain to Cloudflare's network. The SSL certificate, issued by Let's Encrypt (serial number E8), provides HTTPS encryption but does not mitigate the underlying malicious intent. The page title, 'TradeVornax 365™ 2026: Offizielle KI-Plattform Deutschland,' explicitly impersonates Binance, leveraging branding and regional targeting to deceive users.

Google Safe Browsing flags the domain for social engineering, while three security blocklists—PhishDestroy, MetaMask, and SEAL—have actively blocked it. Gridinsoft assigns a trust score of 0/100, reinforcing its malicious classification. VirusTotal reports detection by 14 of 93 security vendors, though the absence of additional context limits further interpretation of these results. Infrastructure analysis reveals the use of HTTP/3 and HSTS, likely employed to evade detection and enhance perceived legitimacy.

The domain's current offline status suggests takedown action, though historical data indicates prior active exploitation. Defenders should treat this domain as confirmed malicious, particularly in environments where Binance or cryptocurrency-related services are accessed. No evidence of a phishing kit or additional payload delivery was identified in the available data, but the domain's structure and branding align with credential-harvesting campaigns. Organizations are advised to update blocklists and monitor for related domains leveraging similar naming conventions or Cloudflare-hosted infrastructure.