parifrance[.]fun

The domain www.parifrance.fun was observed hosting a brand‑impersonation campaign targeting the financial brand “argent”. The site presented the page title “PariFrance – Le Foot en Direct”, which does not reference the targeted brand, indicating that the content has not been publicly analyzed. The domain was registered on 1 December 2025 via Porkbun LLC and is delegated to the Cloudflare nameservers lennon.ns.cloudflare.com and melina.ns.cloudflare.com. DNS resolution points to the IPv6 address 2606:4700:3035::6815:246d, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated to the United States. No TLS certificate was observed; the service responded without SSL, which may hinder automated HTTPS‑only filtering.

Security‑vendor scanning on VirusTotal recorded a single positive detection out of ninety‑five scanners, and the domain is listed on one external blocklist. PhishDestroy has already taken the domain offline, and the current status is reported as “taken offline”. The Gridinsoft trust score of 0 / 100 further reflects a highly suspicious reputation. Evidence is limited to the registration metadata, DNS data, and the single vendor flag; no additional payload, HTTP response codes, or content snapshots are available.

Consequently, the precise phishing kit, credential‑stealing mechanisms, or malicious redirects remain unknown. Defenders should continue to block the domain at the network perimeter, monitor DNS queries for the associated IPv6 address and Cloudflare nameservers, and add the domain to internal blocklists. Because the domain is already offline, incident response teams can focus on detecting any residual phishing emails or related infrastructure that may reference the same brand target or registrar. Ongoing vigilance is advised in case the operators redeploy the campaign under a new domain.