nethertoxagent-invest[.]com

Analysis of nethertoxagent-invest.com, registered on February 21 2026 through Name SRS AB, shows a brand impersonation campaign targeting Argent. The site, now taken offline, presented the page title "NethertoxAGENT™: Offizielles KI-Trading in Deutschland | Geprüft & Vertrauenswür", indicating an alleged AI-driven trading service and aligning with a crypto scam narrative. The domain resolves to IP address 172.67.156.37, which is owned by Cloudflare, Inc. (AS13335) and geolocated in the United States, a common hosting choice for malicious actors that obscures the true origin of the infrastructure. No TLS certificate was observed, leaving the site unencrypted and further confirming its lack of legitimate security posture.

The Gridinsoft trust score of 0 out of 100 reflects an extremely low reputation, and the domain appears on a single security blocklist. VirusTotal reports two detections out of ninety-three scanning engines, indicating that multiple vendors have flagged the domain as malicious, though the majority of scans did not generate a positive result. AlienVault OTX lists the domain in one threat‑intel pulse, and PhishDestroy has actively blocked it.

Nameservers elsa.ns.cloudflare.com and weston.ns.cloudflare.com are standard Cloudflare resolvers, providing no additional attribution. Defenders should immediately block nethertoxagent-invest.com at perimeter and endpoint controls, monitor for any other domains resolving to the same Cloudflare IP range, and incorporate the observed indicators—creation date, registrar, page title, and detection counts—into threat‑intel feeds. Ongoing surveillance of Cloudflare‑hosted assets that reference Argent or AI‑trading terminology is advised to preempt replication of this impersonation vector.