fexovion-es[.]com

Analysis of the domain fexovion-es.com shows a short‑lived infrastructure that was taken offline after detection. The domain was registered on February 21, 2026 through Name SRS AB and resolves to the Cloudflare address 104.21.21.52, which is advertised as being located in the United States under ASN 13335 (Cloudflare, Inc.). No TLS certificate was observed, indicating that the site was served over plain HTTP. The authoritative nameservers are huxley.ns.cloudflare.com and kristina.ns.cloudflare.com, both typical of Cloudflare‑hosted services. The page title returned by the live host before takedown was "Fexovion - Plataforma Oficial | Trading IA 2025 | Más de 10.000 Reseñas", suggesting a fraudulent trading platform narrative.

The site explicitly impersonates the brand "argent", matching the recorded scam type of brand impersonation. Reputation services assign extremely low trust scores: Scamadviser rates the domain 1/100 and Gridinsoft 0/100, reinforcing the malicious intent. Detection signals include inclusion on a single security blocklist, a single AlienVault OTX pulse, and a VirusTotal scan that flagged the domain by 2 of 93 security vendors. PhishDestroy has also listed the domain as blocked.

While the exact content of the landing page was not captured, the combination of brand targeting, low trust scores, and multiple vendor detections provides strong evidence of a credential‑stealing or fraudulent investment scheme. Defenders should continue to block the domain at perimeter filters, monitor the associated IP address for any re‑use, and update threat‑intel feeds with the observed indicators. Because the domain is already offline, ongoing surveillance of related Cloudflare IP ranges and the registrar Name SRS AB may help identify future spin‑offs. Organizations that handle "argent" brand credentials should be alerted to this impersonation attempt and advised to enforce multi‑factor authentication and user awareness training.