ferme-invion[.]net

The domain ferme-invion.net was registered on February 21, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently taken offline. The site presented the page title "Ferme Invion - Plateforme officielle | Trading IA 2025 | Plus de 10 000 avis," indicating a likely attempt to impersonate a trading or investment service. Infrastructure analysis shows the domain resolves to the Cloudflare address 104.21.75.244, located in the United States and associated with ASN 13335 (Cloudflare, Inc.). The DNS configuration uses the Cloudflare nameservers kellen.ns.cloudflare.com and tara.ns.cloudflare.com, and the service advertises HSTS, HTTP/3, and Cloudflare security features.

The SSL certificate is issued by Google Trust Services under the WE1 root, confirming a valid TLS handshake but offering no indication of legitimacy. Reputation data includes a Gridinsoft trust score of 0 out of 100, a clear indicator of high risk, and the domain appears on a single security blocklist, specifically PhishDestroy, which has already flagged it as malicious. VirusTotal analysis reports two of ninety-three scanning engines flagging the domain, providing additional corroboration of suspicious activity.

While the exact content of the hosted page has not been captured, the combination of a targeted page title, low trust score, blocklist presence, and partial VirusTotal detections strongly suggests a generic phishing operation aimed at harvesting credentials or financial information. Defensive recommendations are to immediately block the domain at perimeter firewalls and DNS filtering solutions, continue monitoring for any resurrection attempts, and update internal threat intel feeds with the observed indicators, including the IP address 104.21.75.244, the Cloudflare nameservers, and the SSL certificate issuer. Ongoing vigilance is advised given the recent registration date and the potential for rapid re‑deployment using the same infrastructure.