trd[.]primeweallthltd[.]io

Analysis of trd.primeweallthltd.io indicates a brand‑impersonation campaign targeting the cryptocurrency brand Argent. The domain was registered on 21 February 2026 and currently resolves to the Cloudflare address 172.67.132.4, ASN 13335, located in the United States. The TLS certificate is identified as “WE1”, which is typical of automatically issued Cloudflare certificates and does not provide any legitimacy. The site’s HTML title is “PrimeWealth”, a name unrelated to Argent, suggesting the operator is attempting to lure victims with a financial‑themed facade.

Gridinsoft assigns a trust score of 0 / 100, reflecting a high likelihood of malicious intent. VirusTotal scans show five of ninety‑three antivirus engines flag the domain, and three independent blocklists have already listed it. It is also blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the assessment that the domain is being used for a crypto‑related fraud. The current HTTP status is offline, which may indicate a temporary takedown or a shift to a new command‑and‑control point.

Uncertainty remains regarding the exact payload delivered, the presence of credential‑stealing forms, or any active transaction‑draining scripts, because the site content has not been captured. Defenders should continue to block the hostname at perimeter and DNS layers, monitor outbound traffic to the Cloudflare IP for anomalous connections, and update any web‑filter or anti‑phishing feeds with the observed indicators. Incident response teams investigating Argent‑related compromise should treat any credential or wallet address submissions linked to this domain as compromised. Ongoing threat‑intel collection should watch for re‑registration of similar sub‑domains or the emergence of new URLs that reuse the “primeweallthltd.io” base.