net-paycore[.]com

Analysis of net-paycore.com indicates a high-risk brand-impersonation campaign targeting the financial brand argent. The domain was registered through NETIM SAS on July 29 2025 and remains active as of the report date. The registration details do not reveal any additional organizational affiliation, and the domain’s public WHOIS record lists a single nameserver, suggesting limited DNS complexity. Infrastructure analysis shows that net-paycore.com resolves to the IPv4 address 45.9.148.131, which is advertised by AS49447 Nice IT Services Group Inc. and geolocated to the Netherlands. The server presents a valid Let's Encrypt R12 certificate, indicating the use of automated TLS provisioning. No further hosting fingerprints are disclosed beyond the ASN, and the domain’s HTTP response returns status 200, confirming an active web service. Threat intelligence flags reinforce the malicious posture. VirusTotal records 11 of 95 security vendors flagging the domain, and Gridinsoft assigns a trust score of 0 out of 100. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy remediation service. The page title returned by the web server reads "Net Paycore | Site officiel de Belgium 2025," which aligns with the claimed impersonation of argent. Defenders should treat net-paycore.com as a confirmed hostile resource. Immediate actions include adding the domain and its resolved IP address to network-level blocklists, configuring URL filtering to deny any HTTP/HTTPS traffic to the host, and monitoring DNS queries for the associated nameserver. Because the site content beyond the title has not been publicly analysed, additional sandbox or manual inspection is recommended to uncover any credential-harvesting forms or malicious payloads that may be delivered. Continuous re-evaluation is advised, as the infrastructure could be repurposed or expanded.