nobilefluxent-tr[.]com

Analysis of nobilefluxent-tr.com shows that the domain was registered on 21 February 2026 through INWX GmbH and points to the Cloudflare IP address 104.21.56.243, which belongs to ASN 13335 (Cloudflare, Inc.) in the United States. The domain resolves to this IP but currently returns no HTTP response because the site is marked offline. No TLS certificate is presented, confirming the absence of HTTPS protection. The authoritative name servers are aria.ns.cloudflare.com and elmo.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service.

Reputation data is uniformly negative. Gridinsoft assigns a trust score of 0 out of 100, and the domain is listed on a single security blocklist, specifically PhishDestroy, which has already blocked it. VirusTotal records two detections out of ninety‑three scanning engines, reinforcing the malicious classification. AlienVault OTX references the domain in one threat‑intel pulse, providing additional corroboration of abuse.

The page title harvested from the site, “Nobile Fluxent - Resmi Platform | AI Ticaret 2025 | 10.000'den Fazla Yorum,” contains no direct reference to the targeted brand; however, the intelligence set explicitly flags the domain as impersonating the brand “argent.” Given the combination of a recent registration date, Cloudflare hosting, lack of SSL, low trust score, blocklist presence, and multiple vendor detections, the infrastructure aligns with typical brand‑impersonation campaigns. The exact content served by the site has not been captured, so the specific tactics remain unknown. Defenders should block any DNS resolution to 104.21.56.243 for the domain nobilefluxent‑tr.com, add the domain to web‑filter and email‑filter blocklists, and monitor for any related C2 communication that may use the same Cloudflare IP range. Continuous re‑scanning with VirusTotal and other sandbox services is advised to capture any future payloads should the site come back online.