wekorose[.]digital

This domain, wekorose.digital, is flagged for brand impersonation targeting Argent, a known cryptocurrency wallet provider. Analysis indicates the site was designed to deceive users into believing they were interacting with legitimate Argent services, likely to facilitate unauthorized transactions or credential harvesting. The page title, WhatsApp Bot, suggests an attempt to exploit trust in messaging platforms to distribute fraudulent links or automate social engineering attacks. No evidence of a crypto drainer kit was identified, but the infrastructure aligns with tactics used in credential theft campaigns. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., a provider frequently leveraged by malicious actors to obfuscate hosting origins. The domain resolves to the IPv6 address 2606:4700:3036::6815:11d4, hosted on AS13335 (Cloudflare, Inc.) in the United States. At the time of assessment, no SSL certificate was present, increasing the likelihood of interception or tampering. The domain appears on two security blocklists, PhishDestroy and PhishingDB, and is detected by 19 out of 95 security vendors on VirusTotal. No creation date was provided, but the absence of a Google Safe Browsing (GSB) entry suggests limited historical visibility or recent registration. Current status indicates the domain has been taken offline, reducing immediate exposure risk. However, the elevated detection rate and prior blocklist inclusion warrant continued monitoring. Response actions should include notifying the registrar to prevent re-registration under similar names and alerting the targeted brand for further mitigation. Remaining risks include potential re-emergence of the domain or migration to alternative infrastructure. Organizations are advised to block the domain and associated IP at the network level, while end-users should verify all communications purportedly from Argent through official channels to avoid falling victim to similar impersonation schemes.