fomchoby[.]digital

Analysis as of July 24, 2026 indicates that the domain fomchoby.digital has been taken offline but exhibits multiple indicators of a high‑risk brand‑impersonation campaign targeting the financial services brand argent. The domain was registered on February 21, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the Cloudflare‑owned address 104.21.45.20, which belongs to ASN 13335 (Cloudflare, Inc.) and is located in the United States. The hosting infrastructure uses Cloudflare services and supports HTTP/3, with authoritative nameservers dax.ns.cloudflare.com and kira.ns.cloudflare.com. The site presented the page title “Helvionex”, which does not correspond to the advertised brand, and the SSL certificate was issued by Google Trust Services under the WE1 designation, confirming the use of a legitimate certificate authority but not validating the legitimacy of the content. Reputation data shows a Gridinsoft trust score of 0 out of 100, indicating extreme distrust.

Google Safe Browsing classifies the domain as a social‑engineering threat, and three independent blocklists (PhishDestroy, MetaMask, and SEAL) have already listed the host. AlienVault OTX reports the domain in a single threat‑intelligence pulse. VirusTotal analysis flagged the domain by 21 of 95 security vendors, reinforcing the malicious assessment. The overall risk rating is high, and the current status is offline, suggesting that the operators may be rotating infrastructure.

While the technical footprint is well documented, the exact content served before takedown has not been publicly released, and the specific lure mechanisms remain unknown. Defenders should continue to block the domain at network perimeters, update URL filtering rules with the observed indicators, and monitor the associated IP address 104.21.45.20 for any re‑use in future campaigns. Ongoing surveillance of the Cloudflare ASN and related nameservers is recommended, as the infrastructure can be repurposed quickly.