velzomerinex[.]com

Analysis of velzomerinex.com indicates that the domain is being used for a brand impersonation campaign targeting the financial services brand Argent. The site, now taken offline, was first registered on 21 February 2026 via Name SRS AB and is hosted behind Cloudflare’s network (AS13335) at IP address 172.67.144.203, a location attributed to the United States. The authoritative name servers are beau.ns.cloudflare.com and dahlia.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. The page title observed before takedown reads “Velzomerinex – Offizielle Plattform | KI‑Trading 2025 | Über 10.000 Bewertungen”, suggesting a fabricated German‑language platform that promotes artificial‑intelligence trading services and claims a large number of user reviews, a pattern typical of social‑media phishing lures. Security telemetry shows a zero trust score from Gridinsoft (0/100) and inclusion on a single security blocklist.

The domain lacks an SSL certificate, exposing any HTTP traffic to interception. Six of ninety‑three VirusTotal scanners flagged the domain, and PhishDestroy has listed it as blocked, indicating that multiple anti‑phishing engines recognize it as malicious. AlienVault OTX references the domain in one threat‑intelligence pulse, further corroborating its association with malicious activity. The precise phishing kit or credential‑harvesting mechanism has not been disclosed; the offline status prevents current content analysis, and no additional artifacts such as malicious scripts or redirect URLs have been captured. Consequently, the full scope of the campaign—such as victim count, lure distribution channels, or data exfiltration methods—remains uncertain.

Defenders should continue to block traffic to velzomerinex.com at perimeter firewalls and DNS resolvers, especially given its association with social‑media phishing and brand impersonation of Argent.