soryne-varex[.]com

On 24 July 2026, the domain soryne-varex.com was observed as offline but retains indicators of a brand‑impersonation campaign targeting the financial service brand argent. The site was registered on 21 February 2026 through Name SRS AB and resolves to the Cloudflare address 172.67.216.121, belonging to ASN 13335 in the United States. No TLS certificate is presented, meaning connections are unencrypted. The authoritative nameservers are ethan.ns.cloudflare.com and virginia.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure.

The page title returned by the HTTP response reads “Soryne Varex - Plateforme officielle | Trading IA 2025 | Plus de 10 000 avis”, which suggests a fabricated trading platform narrative but the content has not been captured for further analysis. Security‑vendor telemetry shows a Gridinsoft trust score of 0 / 100 and a single detection on VirusTotal, where one of ninety‑three scanners flagged the domain. The domain appears on one public blocklist and is listed in a single AlienVault OTX pulse, indicating limited but existing community awareness. PhishDestroy has already blocked the domain, and the classification provided is “Social Media Phishing”, implying that attackers may distribute malicious links via social channels to lure victims into credential harvesting.

The limited detection footprint and the recent creation date leave uncertainty regarding the scale of the campaign and the specific malicious payloads employed. Defenders should add the domain and its IP address to web‑filter and DNS‑sinkhole rules, monitor for outbound connections to the Cloudflare IP range, and inspect any traffic that references the page title or brand name argent for potential credential‑theft attempts. Ongoing observation of the associated blocklist entries and any future VirusTotal scans is recommended to assess whether additional detection vendors identify the infrastructure as malicious.