instant750-arvo[.]com

On July 24, 2026 analysts reviewed the domain instant750-arvo.com, which is currently offline but was previously identified as a brand‑impersonation operation targeting the financial service brand argent. The site presented the page title “Instant +750 Arvo - Plataforma Oficial | Trading IA 2025 | Más de 10.000 Reseñas,” indicating an attempt to lure Spanish‑speaking users with promises of high returns. DNS resolution points to the IP address 104.21.96.120, hosted within the Cloudflare network (AS13335) and physically located in the United States. The domain uses Cloudflare’s default nameservers huxley.ns.cloudflare.com and kristina.ns.cloudflare.com, and no SSL certificate was observed, leaving the site vulnerable to man‑in‑the‑middle interception.

Registration details show the domain was created on February 21, 2026 through the registrar Name SRS AB. Reputation scoring is extremely low, with Gridinsoft assigning a trust score of 0 out of 100. VirusTotal analysis recorded two detections out of ninety‑three scanning engines, and the domain appears on a single security blocklist, specifically PhishDestroy. AlienVault’s Open Threat Exchange listed the domain in one threat‑intel pulse, confirming its association with malicious activity.

The elevated risk rating reflects the combination of brand impersonation, low trust score, and detection by multiple vendors. At present, the exact payload or credential‑stealing mechanisms employed by the site remain unknown because the site is offline and no page content beyond the title has been captured. Defenders should continue to block the domain and its associated IP at perimeter and DNS layers, monitor for any re‑registration attempts, and update threat‑intel feeds with the observed indicators of compromise. Incident response teams should also watch for related domains that share the same registrar or Cloudflare nameservers, as these may be part of a broader campaign targeting argent users.