bingbiya[.]digital

Analysis on bingbiya.digital indicates a high‑risk brand‑impersonation campaign targeting the cryptocurrency brand Argent. The domain was registered on 21 January 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is delegated to the nameservers ns1.suspended-domain.com and ns2.suspended-domain.com. DNS resolution points to 172.67.149.240, an address owned by Cloudflare, Inc. (AS13335) and geolocated in the United States. No TLS certificate is presented for the host, suggesting the site is either served over plain HTTP or is currently inaccessible; the current status is reported as offline. Google Safe Browsing has flagged the domain for social‑engineering activity, and VirusTotal records show that 19 of 95 scanned security vendors have generated detections against the host.

The domain appears on three public blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL. AlienVault OTX references the domain in two separate threat‑intel pulses, reinforcing its association with malicious activity. Gridinsoft assigns a trust score of 0 / 100, indicating a complete lack of credibility. The only visible content retrieved prior to takedown is the page title “Helvionex – ICO & Crypto,” which does not directly reference Argent but is consistent with a crypto‑focused lure. The campaign is classified as a brand‑impersonation attempt, with Argent identified as the targeted brand.

No additional artifacts such as login forms, malicious scripts, or payloads have been observed, leaving the exact technique of credential or fund theft unresolved. Defenders should block the domain at network perimeter and update endpoint and browser security policies to include the listed blocklists. Continuous monitoring of Cloudflare‑hosted IP ranges for similar domains is advisable, as the infrastructure can be rapidly reused.