fundspireplataforma[.]org

On 24 July 2026 the domain fundspireplataforma.org was observed and subsequently taken offline. The domain was registered on 21 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. It uses Cloudflare’s authoritative nameservers aria.ns.cloudflare.com and elmo.ns.cloudflare.com and resolves to the IP address 172.67.211.133, which is associated with AS13335 Cloudflare, Inc. and geolocated to the United States. No TLS certificate was presented when the host was queried, indicating the site was served over plain HTTP. The only visible artifact is the page title “Fundspire Plataforma - Resmi Platform | AI Ticaret 2025 | 10.000'den Fazla Yorum”, which does not reference the targeted brand.

The infrastructure is classified as a brand‑impersonation campaign targeting the financial brand “argent”. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single security blocklist. PhishDestroy has already blocked the domain. VirusTotal analysis shows that four of ninety‑three scanning engines flagged the domain, confirming malicious intent. The lack of an SSL certificate further reduces user trust and makes the site vulnerable to man‑in‑the‑middle tampering, a trait commonly seen in low‑sophistication phishing kits.

Although the page title contains Turkish language elements, no direct reference to argent is displayed, indicating the impersonation may rely on external distribution channels rather than on‑page branding. Because the domain relies on Cloudflare’s edge network, investigators may need to request logs from Cloudflare to identify the origin server, if any, behind the service. No evidence of additional infrastructure such as command‑and‑control servers or malware drop points has been uncovered at this time.