undressaitools[.]net

Analysis of undressaitools.net shows a newly registered domain (02 Oct 2025) hosted on Amazon infrastructure (AS16509) and fronted by Cloudflare DNS (ed.ns.cloudflare.com, sandra.ns.cloudflare.com). The site resolves to IP 216.150.1.1 in the United States and presents a valid Google Trust Services SSL certificate (WE1). HTTP response code 200 and support for HTTP/3 indicate an operational web service. The page title “Undress AI App - Create Deepnude Images for FREE | undressaitools.net Undress” suggests a deceptive offering that aligns with the classified brand impersonation targeting the Argent brand. MX records point to Proton Mail (mail.protonmail.ch, priority 10) and a secondary mail server, confirming use of ProtonMail’s mail infrastructure. Detected technologies include Tailwind CSS, Cloudflare Browser Insights, and HTTP/3. Reputation metrics are extremely low, with Gridinsoft assigning a trust score of 1/100 and 14 of 95 VirusTotal scanners flagging the domain. The domain appears on one security blocklist and has been blocked by PhishDestroy. Current status is active. No additional forensic evidence about payload delivery or credential harvesting has been disclosed; the exact malicious behavior beyond the brand‑impersonation claim remains unverified. Defenders should consider immediate DNS sink‑hole or firewall rule to block traffic to undressaitools.net, add the domain to email and web filtering policies, and monitor for similar domains registered through Porkbun that use Cloudflare front‑ends and ProtonMail MX records. Continuous observation of the associated IP range (216.150.1.0/24) and ASN 16509 is advised to detect possible expansion of the infrastructure.