legacybitfundex[.]org

Analysis of the domain legacybitfundex.org indicates a confirmed phishing campaign targeting users of the Argent brand. The domain was registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the domain resolves to the IP address 172.67.169.101, hosted on Cloudflare's network (AS13335), a common tactic to obscure the true origin of malicious sites. Nameservers augustus.ns.cloudflare.com and jessica.ns.cloudflare.com further confirm Cloudflare's involvement in the domain's DNS configuration. The page title, 'Legacy Bitfundex - Offizielle Plattform | KI-Trading 2025 | Über 10.000 Bewertungen,' suggests an attempt to impersonate a legitimate trading or financial platform, specifically targeting German-speaking users. While the exact content of the site remains unanalyzed, the presence of terms like 'KI-Trading' and fabricated social proof ('Über 10.000 Bewertungen') aligns with known brand impersonation tactics.

The domain is explicitly flagged for impersonating Argent, though no further details about the phishing kit or specific attack vectors are available at this time. Security vendor detections are limited but indicative of malicious intent. As of the latest scan, 5 out of 95 security vendors on VirusTotal have flagged the domain, a modest but notable detection rate for a recently registered domain. The domain also appears on one security blocklist, specifically PhishDestroy, which specializes in phishing detection. Gridinsoft's trust score of 0/100 further corroborates the elevated risk level.

Notably, the domain lacks an SSL certificate, a red flag for any site handling user credentials or financial data, though this is not uncommon for low-effort phishing campaigns. The domain is currently offline, which may indicate takedown action or the conclusion of an active campaign.