midasbuy[.]fulio[.]icu

Analysis of midasbuy.fulio.icu indicates a newly observed brand‑impersonation infrastructure targeting the Argent brand. The domain was registered on 21 November 2025 through Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn) and uses the provider’s default nameservers dns9.hichina.com and dns10.hichina.com. No TLS certificate is presented, meaning the site would be served over plain HTTP if accessed. HTTP requests resolve to the IPv4 address 45.207.204.6, which belongs to AS8796 FASTNET DATA INC and is geolocated in the United States. The host appears on a single public blocklist and has been taken offline, with PhishDestroy reporting the takedown.

Gridinsoft assigns a trust score of 0 / 100, reflecting a high likelihood of malicious use. On VirusTotal, 18 of 95 scanners flagged the domain, corroborating the suspicion. The only page‑title observed is “PUBG MOBILE EVENT”, which does not match the claimed target brand and may be used to lure victims with a popular game‑related lure. The impersonated brand is explicitly listed as “argent”, confirming the intent to deceive users seeking legitimate Argent services.

At present, no additional payload, credential‑harvesting pages, or redirect behavior have been publicly disclosed, leaving the exact phishing flow uncertain. Defenders should block the domain and its resolving IP at perimeter defenses, monitor DNS queries for the domain or its nameservers, and add the host to internal blocklists. Continuous re‑inspection of the IP range 45.207.204.0/24 is advised, as the operator may redeploy the campaign under a new domain. Incident response teams should also review recent Argent‑related traffic for signs of credential submission attempts that could be tied to this infrastructure.