bitnoteluxmora-fr[.]com

The domain bitnoteluxmora-fr.com was registered on 21 February 2026 through Metaregistrar BV and immediately pointed to the Cloudflare network (ASN 13335) at IP address 172.67.180.21, a US‑based hosting location. No TLS certificate was observed, indicating the site was served over plain HTTP or an improperly configured HTTPS endpoint. The site’s HTML title reads “Bitnote Luxmora – Plateforme officielle | Trading IA 2025 | Plus de 10 000 avis”, a typical phrasing used to lure victims with promises of automated trading and large numbers of reviews. The domain is classified as a brand‑impersonation campaign targeting the “argent” brand, and the page title suggests a fraudulent investment or trading service. Multiple defensive feeds have flagged the domain.

PhishDestroy has taken the domain offline and listed it as a confirmed impersonation site. VirusTotal recorded a single positive detection out of 93 scanned engines, and Gridinsoft assigned a trust score of 0 / 100, reflecting a high likelihood of malicious intent. The domain also appears on one external blocklist, reinforcing its reputation as a malicious resource. The lack of an SSL certificate, combined with the use of Cloudflare’s generic nameservers (alberto.ns.cloudflare.com, marjory.ns.cloudflare.com), is consistent with a rapid‑deployment infrastructure often employed by threat actors to avoid attribution. No additional evidence such as Safe Browsing entries, OTX indicators, or publicly available screenshots has been disclosed, leaving the exact content and user‑experience of the site unverified.

Defenders should add bitnoteluxmora-fr.com to URL filtering and endpoint allow‑lists as a high‑confidence malicious indicator. Network monitoring rules should block outbound connections to 172.67.180.21 and any future resolution of the domain. Email security gateways should treat messages referencing the “argent” brand and containing this domain as suspicious.