xvp-650-ronz[.]com

Analysis of xvp-650-ronz.com shows a newly registered domain created on February 21, 2026 that was used to impersonate the brand argent. The site resolved to the Cloudflare‑owned address 172.67.222.236, an IP located in the United States and announced as part of ASN 13335 (Cloudflare, Inc.). The domain was hosted on Cloudflare nameservers ara.ns.cloudflare.com and ricardo.ns.cloudflare.com, and it presented the generic Cloudflare warning page with the title “Suspected phishing site | Cloudflare”. No TLS certificate was observed, indicating the site operated without a valid HTTPS identity.

Reputation data is uniformly negative: Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single security blocklist. VirusTotal recorded a single positive detection out of 93 scanning engines, reinforcing the suspicion of malicious intent. PhishDestroy has already taken the domain offline, and the current status is reported as taken offline. The limited detection footprint suggests that the campaign may have been short‑lived or targeted, but the presence of a brand‑specific impersonation flag indicates an attempt to harvest credentials or deceive users of argent.

Defenders should continue to block the IP address 172.67.222.236 at the network perimeter, add xvp-650-ronz.com to URL filtering and domain reputation lists, and monitor for any re‑registration of the same second‑level domain or variations that reuse the same registrar (PublicDomainRegistry.com). Because the site leveraged Cloudflare infrastructure, future impersonation attempts may also appear behind shared Cloudflare IPs, so correlation with the specific domain name and observed page title is essential for accurate detection. Continuous threat‑intel feeds should be consulted for any resurgence of the domain or related indicators, and incident response teams should treat any emails or links referencing argent that resolve to this domain as malicious.