scoreinvest[.]fr

scoreinvest.fr was first observed on March 06, 2026 and is presently classified as a high‑risk investment phishing site. The page title, “ScoreInvest.fr - Simulateurs et Outils Gratuits pour Investir en 2026”, mimics legitimate financial tools and aims to lure users into disclosing personal or financial information. The site presents a valid SSL certificate issued by Google Trust Services under the WE1 profile, which may give a false sense of legitimacy.

Technical infrastructure shows the domain resolves to 188.114.96.3, an address owned by Cloudflare, Inc. (AS13335) and located in the United States. The domain is delegated to the Cloudflare nameservers jeff.ns.cloudflare.com and nancy.ns.cloudflare.com, a common pattern for proxy‑based phishing operations. Registration records list Hostinger operations, UAB as the registrar, providing no direct association with the threat actor.

Threat intelligence indicates the domain is blocked by three independent blocklists, specifically PhishDestroy, MetaMask, and SEAL, and appears on three additional security blocklists. The Gridinsoft trust score is 0 out of 100, reflecting an extremely low reputation. VirusTotal analysis shows that 4 of 95 scanned security vendors flagged the domain, reinforcing the malicious classification. The site returns HTTP status 200, confirming that the content is actively served.

Defenders should add scoreinvest.fr to URL filtering and DNS block policies, and monitor for any outbound connections to the 188.114.96.3 address. Because the domain uses reputable SSL and Cloudflare infrastructure, passive DNS or certificate monitoring alone may miss future variants; active inspection of page content and heuristic detection of investment‑related language are recommended. Continuous re‑evaluation is advised, as the low trust score and existing blocklist entries suggest the campaign remains operative.