bexlorit-ki[.]com

Analysis of the domain bexlorit-ki.com confirms its classification as a high-risk phishing site impersonating Binance, a cryptocurrency exchange. The domain was registered on February 21, 2026, through Hosting Concepts B.V. d/b/a Registrar.eu, with nameservers assigned to ina1.registrar.eu, ina2.registrar.eu, and ina3.registrar.eu. Infrastructure analysis reveals resolution to IP address 104.21.75.28, hosted on Cloudflare's network (AS13335) in the United States. No SSL certificate was detected, increasing the risk of unencrypted data transmission. The domain is currently offline, returning an HTTP 410 status code, which indicates intentional removal or decommissioning.

Prior to takedown, the page title 'Bexlorit™ - KI-Trading Deutschland 2026' was observed, suggesting a localized German-language phishing campaign targeting users with artificial intelligence-themed trading scams. While the exact content of the site remains unanalyzed, the combination of the page title and the declared brand target (Binance) aligns with known tactics of fraudulent investment schemes. Detection data supports the malicious classification: the domain appears on three security blocklists, is flagged by Google Safe Browsing for social engineering, and holds a Gridinsoft trust score of 0/100. Sixteen of 95 security vendors on VirusTotal flagged the domain as malicious prior to its removal. Protective measures by PhishDestroy, MetaMask, and SEAL further corroborate the phishing assessment.

Defenders should treat this domain as confirmed malicious infrastructure. Although currently offline, historical DNS records and detection timestamps should be preserved for forensic analysis. Organizations are advised to block the domain, its resolved IP, and monitor for re-registration or related domains using similar naming conventions or registrar patterns. No evidence of a phishing kit or additional payloads was provided; further investigation into associated campaigns is recommended.