beastfintrox[.]net

On 24 July 2026 investigators identified the domain beastfintrox.net as part of a Binance brand impersonation campaign. The domain was registered on 21 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the IP address 172.67.212.166, which belongs to AS13335 Cloudflare, Inc. in the United States. DNS resolution uses the Cloudflare authoritative nameservers novalee.ns.cloudflare.com and scott.ns.cloudflare.com, confirming that the hosting infrastructure is provided by Cloudflare. The TLS certificate presented by the site is issued by Cloudflare TLS Issuing ECC CA 3 to the organization “SSL Corporation”, a common pattern for abused Cloudflare services. An HTTP request to the root URL returned a 403 status code, indicating that the server is currently refusing access, and the domain is listed as taken offline by the monitoring service PhishDestroy.

The page title retrieved during analysis reads “Beastfintrox - Offizielle Plattform | KI‑Trading 2025 | Über 10.000 Bewertungen”, which references a German‑language trading service and does not contain visible Binance branding, but the domain is explicitly marked as impersonating Binance. VirusTotal scans reported nine positive detections out of ninety‑three security vendors, confirming that multiple anti‑malware engines consider the domain malicious. The domain appears on a single security blocklist and is referenced in one AlienVault OTX pulse, providing additional corroboration of its threat status. Evidence gaps remain regarding the exact content served before the site was taken offline; the page title alone does not reveal whether credential‑stealing forms or malicious downloads were present.

No Safe Browsing or additional reputation scores are provided in the available data. Defenders should add beastfintrox.net to URL filtering and host‑based blocklists, monitor traffic to its Cloudflare IP range, and consider the associated nameservers as potential indicators of compromise.