redleafcorebit-invest[.]com

Analysis of redleafcorebit-invest.com shows a newly created domain (27 Oct 2025) that was hosted on Cloudflare infrastructure (IP 172.67.145.187, AS13335, United States). The domain resolves to the same IP used by many legitimate Cloudflare customers, but the lack of an SSL certificate indicates the site was not serving HTTPS content. The page title returned by the HTTP response, “Redleaf Corebit – Official Platform | AI Trading 2025 | Over 10,000 Reviews”, aligns with typical investment‑scam narratives that promise AI‑driven returns and large user bases. The domain explicitly impersonates the brand “argent”, as indicated in the intelligence feed, and is classified as an investment scam.

Reputation checks are uniformly negative: Gridinsoft assigned a trust score of 0 / 100, and VirusTotal reported detections by eight of ninety‑five scanning engines. The registrar listed is Name SRS AB, and the domain uses Cloudflare’s default nameservers (burt.ns.cloudflare.com, nadia.ns.cloudflare.com). Threat‑intel sources have added the domain to a single blocklist, PhishDestroy, and AlienVault OTX records a single pulse referencing the domain. The current HTTP status is offline, suggesting the site has been taken down or is temporarily unavailable.

No additional artifacts such as phishing kits, malware payloads, or credential‑harvesting forms have been observed. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑registration or resurrection of the same host name, and consider adding the IP address range to cloud‑based threat feeds. Ongoing vigilance is advised for other domains that share the same registrar, naming pattern, or page‑title keywords, as they may be part of a broader campaign targeting the argent brand.