thames-ai[.]com

Analysis indicates that the domain thames-ai.com was registered on 21 February 2026 through Name SRS AB and is currently resolved to the Cloudflare address 104.21.4.202 (AS13335, United States). The authoritative nameservers are kolton.ns.cloudflare.com and riya.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. No TLS certificate is presented, and HTTP requests receive no SSL handshake, which is consistent with the reported lack of an SSL certificate. The site’s page title, “Thames AI – Official Platform | AI Trading 2025 | Over 10,000 Reviews”, suggests a fabricated financial service narrative, and the domain is explicitly flagged as a brand‑impersonation campaign targeting the brand argent.

Detection evidence shows that PhishDestroy has taken the site offline and that the domain appears on a single security blocklist. AlienVault OTX lists the domain in one threat‑intel pulse, and Gridinsoft assigns a trust score of 0 out of 100. VirusTotal records a single positive detection out of 93 scanning engines. The limited blocklist presence and the single VirusTotal flag indicate that the malicious infrastructure is still in early deployment or that broader detection coverage has not yet been applied.

Defenders should add thames-ai.com to inbound and outbound filtering rules, monitor DNS queries for the associated Cloudflare IP range, and ensure that any traffic to the domain is blocked at the perimeter. Because the site is already offline, continuous verification of its status is recommended, and analysts should watch for re‑registration attempts or the emergence of similar domains using the same registrar or nameserver pattern. Correlation with alerts referencing the brand argent or the “AI Trading 2025” phrasing can aid in early detection of related campaigns.