noryal-vexor[.]net

Analysis of noryal-vexor.net, created on 21 February 2026 and currently offline, shows a clear brand‑impersonation campaign targeting the financial brand argent. The domain resolves to 104.21.1.181, an address owned by Cloudflare (AS13335) located in the United States. DNS is served by Cloudflare nameservers chloe.ns.cloudflare.com and rayden.ns.cloudflare.com, indicating the use of a reputable CDN for rapid deployment and possible anonymity. No TLS certificate is presented, meaning the site operated without HTTPS protection, a common trait for short‑lived fraudulent pages.

The page title retrieved during the brief crawl reads "Noryal Vexor - Plateforme officielle | Trading IA 2025 | Plus de 10 000 avis," suggesting a fabricated investment or AI‑trading service, but the actual page markup has not been captured because the site is no longer reachable. Detection services on VirusTotal flagged the domain in 10 of 93 vendor scans, confirming that multiple security engines recognize malicious intent. Gridinsoft assigned a trust score of 0 / 100, reinforcing the assessment of high risk. The domain appears on one external security blocklist and is listed by PhishDestroy as blocked, providing additional confirmation that defensive feeds are already filtering the address.

Registration was performed through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently observed in abusive domain registrations, though no evidence of mis‑configuration or compromise is evident beyond the standard WHOIS data. Given the observed indicators—brand impersonation of argent, a suspicious trading‑oriented page title, lack of TLS, a recent creation date, Cloudflare‑based hosting, and multiple vendor detections—defenders should continue to block the domain at perimeter controls, update URL filtering lists, and monitor for any re‑registration attempts. Threat‑intel teams should also watch for similar naming patterns (e.g.