sarvexid-ai[.]com

Analysis of sarvexid-ai.com shows a high‑risk brand‑impersonation campaign targeting Binance. The domain was registered on 21 February 2026 through REALTIME REGISTER B.V. and is hosted on Cloudflare infrastructure (ASN 13335) with the IP address 172.67.148.153 located in the United States. The site served a page titled “Sarvexid™: Offizielles KI‑Trading in Deutschland | Geprüft & Vertrauenswürdig”, but no SSL certificate was observed, indicating an unsecured HTTP service. The domain is currently offline, yet historical data reveal that it was blocked by multiple anti‑phishing solutions, including PhishDestroy, MetaMask, and SEAL, and appears on three independent security blocklists.

Reputation scoring from Gridinsoft assigned a zero‑out‑of‑one‑hundred trust rating, reinforcing the malicious classification. VirusTotal reports that 17 of 93 scanned security vendors flagged the domain, consistent with the observed blocklist activity. Nameservers point to ethan.ns.cloudflare.com and virginia.ns.cloudflare.com, typical of Cloudflare‑managed domains.

While the exact content of the compromised page has not been examined, the presence of a Binance impersonation claim and the page title referencing AI‑driven trading suggest a financial‑theft motive. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑hosting of the same content on related Cloudflare IP ranges, and update detection signatures to include the observed page title and host IP. Ongoing vigilance is advised, as the infrastructure (Cloudflare) may be reused for future impersonation attempts.