api[.]jsdpmnew[.]vip

The domain api.jsdpmnew.vip was registered on 21 February 2026 and currently resolves to the IPv4 address 216.225.199.10, which is assigned to IONOS SE (ASN 8560) in the United States. The host presents an SSL certificate identified as R13, indicating the presence of a TLS layer but offering no indication of legitimate ownership. The site’s HTTP response is presently offline, and the page title returned during the brief scan was “Uphold Pro”. The domain is explicitly linked to a brand‑impersonation campaign targeting the financial service brand argent, as indicated by the “Impersonates: argent” tag and the “Scam type: Brand Impersonation” classification.

Reputation services have uniformly rated the infrastructure as malicious: Gridinsoft assigns a trust score of 0 / 100, and 17 of 93 VirusTotal scanners have flagged the domain as malicious. The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy mitigation service. No additional intelligence such as Safe Browsing, OTX, or registrar details was supplied. The evidence therefore confirms that the domain is being used to deceive users by masquerading as a legitimate service associated with argent, despite the lack of a live payload at the time of analysis.

Defenders should add api.jsdpmnew.vip to URL filtering rules, block the associated IP address 216.225.199.10 at the network perimeter, and monitor for any future re‑activation of the host. Continuous observation of the certificate R13 and periodic rescans with VirusTotal are advised to detect potential changes in the threat posture. Because the site is offline, immediate user‑facing impact is low, but the infrastructure remains compromised and may be re‑used for credential harvesting or other malicious activity.