xn--fortpaycore-ebb[.]fr

Analysis of xn--fortpaycore-ebb.fr shows a newly registered (17 July 2025) domain that resolves to the IPv6 address 2a06:98c1:3120::3 and is serviced by Cloudflare (AS13335). The authoritative nameservers are arturo.ns.cloudflare.com and kayleigh.ns.cloudflare.com, and the site is delivered over HTTP/3 with a Cloudflare‑issued ECC TLS certificate. The page title returned by the HTTP 301 redirect is “Forté Paycore ™ | Site Officiel et Mis à Jour【2025】”, and the domain is classified as a brand‑impersonation campaign targeting the “argent” brand. Detected web technologies include jsDelivr, jQuery, Google Tag Manager and cdnjs, all typical of content‑delivery stacks. Reputation data indicates a Gridinsoft trust score of 0/100 and a single detection by one of 95 VirusTotal scanners. The domain appears on one security blocklist and is currently blocked by PhishDestroy. Infrastructure analysis confirms the domain remains active despite mitigation. No additional content has been captured, so the exact phishing workflow and credential‑capture mechanisms are unknown. Defenders should block the domain at DNS and proxy layers, enforce TLS inspection to verify the Cloudflare certificate, and monitor for any related sub‑domains or similar punycode registrations. Continuous threat‑intel feeds should be consulted for updates, and any observed traffic to the IPv6 address should be logged and investigated.