vang-bot[.]com

This investigation confirms that vang-bot.com was registered on 21 February 2026 through REALTIME REGISTER B.V. and is hosted on Cloudflare’s network (AS13335) with the IP address 104.21.95.193 located in the United States. The domain resolves to Cloudflare’s nameservers julio.ns.cloudflare.com and kallie.ns.cloudflare.com, and it does not present a valid SSL certificate, indicating that any HTTPS connections would be rejected or fall back to an untrusted state. The sole visible page title, “Vangbot – Plateforme officielle | Trading IA 2025 | Plus de 10 000 avis”, suggests a fabricated trading platform and is unrelated to the claimed target brand “argent”. The site is classified as a brand‑impersonation campaign aimed at the argent brand, and PhishDestroy has already taken the domain offline.

Threat intelligence platforms show that two of ninety‑three VirusTotal scanners flagged the domain, and Gridinsoft assigns a trust score of zero out of one hundred, reflecting a high likelihood of malicious intent. The domain appears on one external blocklist, confirming that at least one security provider has added it to their deny list. Current public data do not indicate whether a functional phishing landing page was ever served before takedown, nor are there samples of payloads or credential‑stealing forms. Defenders should immediately add vang-bot.com to URL filtering, DNS‑sinkhole, and endpoint blocklists.

Continuous monitoring of the associated IP range (104.21.95.0/24) and the Cloudflare nameservers is advised, as the actor may reuse the same infrastructure for future campaigns. Additionally, organisations that use the argent brand should reinforce user awareness training, emphasizing that any unsolicited communication referencing “Vangbot” or a “Trading IA 2025” offering is unauthorised. Regular review of threat feeds for re‑registration of similar domains or new aliases using the same registrar will help detect recurrence.