byrqcoin-invest[.]com

Analysis of byrqcoin-invest.com shows multiple indicators of malicious activity targeting the argent brand. The domain was registered on 21 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to IP address 172.67.162.106, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site is served without an SSL certificate, and its authoritative nameservers are lina.ns.cloudflare.com and piotr.ns.cloudflare.com. The page title retrieved from the live site reads "Byrq Coin - Oficiální platforma | AI-Trading 2025 | Více než 10 000 hodnocení," suggesting an investment‑oriented narrative. The domain explicitly impersonates the argent brand and is classified as an investment scam in the provided intelligence.

Detection services have flagged the domain: three of ninety‑three VirusTotal scanners reported it as malicious, and Google Safe Browsing tags it for social engineering. The site appears on one security blocklist and is actively blocked by PhishDestroy. Independent trust scoring from Gridinsoft assigns a score of 0 out of 100, indicating extreme risk. Current monitoring shows the domain is offline, but the infrastructure components—including the Cloudflare IP and public nameservers—remain observable and could be reused for future campaigns.

Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms, as no page content beyond the title has been examined. Defenders should immediately block the domain and its resolving IP address at network perimeter devices, add the domain to local and cloud‑based blocklists, and monitor for newly registered domains using the same registrar or similar naming patterns. Continuous observation of Cloudflare edge nodes associated with the IP may reveal re‑activation. Given the low trust score and social‑engineering flag, any traffic targeting the argent brand should be treated as high‑risk until further forensic evidence is obtained.