Análisis de phishing y seguridad de immutableazopt-fr.live

The domain immutableazopt-fr.live was registered on May 15, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently active. DNS resolution points to the Cloudflare edge address 104.21.72.169, which is hosted in Canada. The site presents a valid TLS certificate from Let’s Encrypt (E8) and returns HTTP 200 responses. The page title advertised is “Immutable Azopt | Plateforme officielle de trading assisté par IA”, directly mimicking the legitimate Immutable brand.

Threat intelligence flags this domain as a brand‑impersonation fake exchange. AlienVault OTX lists it in one pulse, and VirusTotal records three out of ninety‑five security vendors flagging the domain as malicious. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist. The nameservers hal.ns.cloudflare.com and jocelyn.ns.cloudflare.com are typical of Cloudflare‑hosted infrastructure, further confirming the use of a reputable CDN to obscure the attacker’s origin.

While the observed indicators confirm a high‑risk phishing operation, the current evidence does not reveal any payload delivery or credential‑harvesting scripts beyond the deceptive landing page. No malware hashes have been published, and the limited number of detections suggests the site may be in an early deployment phase or employing evasion techniques to stay below detection thresholds.

Defenders should immediately block immutableazopt-fr.live at DNS and proxy layers, and consider adding its resolving IP 104.21.72.169 to network‑wide deny lists. Continuous monitoring of Cloudflare edge IP ranges for new domains referencing the Immutable brand is advised. Users should be warned that any unsolicited communications directing them to this domain are fraudulent, and credential submission should be prohibited.