argen-tu-s--argentabelg8[.]replit[.]app

Analysis of the domain argen-tu-s--argentabelg8.replit.app indicates it is a credential-phishing site impersonating Argenta, a known financial brand. The domain was created on April 16, 2021, and registered through NOM-IQ Ltd dba Com Laude. Infrastructure analysis reveals it resolves to IP address 34.117.33.233, hosted on Google Cloud (AS396982) in the United States, with nameservers ns-cloud-b1.googledomains.com, ns-cloud-b2.googledomains.com, and ns-cloud-b3.googledomains.com. The SSL certificate is issued by Google Trust Services (WR3), and the site uses Google Cloud CDN with HTTP/3 support. The page title, 'Home | Login,' aligns with typical phishing pages targeting login credentials, and the domain is explicitly classified as a credential-phishing threat.

Security vendors have flagged this domain, with 14 out of 93 engines on VirusTotal detecting it as malicious. It appears on at least one security blocklist and is blocked by PhishDestroy. Scamadviser assigns a low trust score of 35 out of 100, further supporting its classification as high-risk. As of July 24, 2026, the domain returns an HTTP 404 status, suggesting it has been taken offline, though defenders should remain cautious as infrastructure may be repurposed.

Defenders are advised to treat this domain as confirmed malicious. Block access at the network level, monitor for related indicators of compromise (IOCs), and alert users to potential phishing risks associated with Argenta impersonation. The use of reputable cloud infrastructure does not mitigate the threat; phishing campaigns frequently abuse legitimate services to evade detection. No evidence suggests this domain is safe or legitimate.