cab[.]ghostglbltd[.]com

Analysis indicates cab.ghostglbltd.com is an active credential-phishing domain targeting users of the Argent cryptocurrency wallet. The domain was registered on July 8, 2025, through Tucows Domains Inc. and currently resolves to Cloudflare IP 172.67.172.231 (AS13335, US). No SSL certificate is present, and the page title reads 'Ghost Global Limited,' which does not match the expected branding of Argent. Google Safe Browsing has flagged this domain for social engineering, and PhishDestroy has blocked it.

Eight of 95 security vendors on VirusTotal detect the domain as malicious, and it appears on at least one security blocklist. Scamadviser and Gridinsoft both assign a trust score of 1/100 and 0/100, respectively, further supporting its classification as high-risk. The domain remains active as of July 24, 2026, with an HTTP 200 status, suggesting the phishing infrastructure is still operational.

Defenders should prioritize blocking this domain at the DNS and proxy levels, monitoring for related subdomains under ghostglbltd.com, and alerting users about potential credential theft attempts targeting Argent wallet holders. The lack of SSL and the mismatch between the page title and the impersonated brand are strong indicators of fraudulent intent. Further investigation into the hosting infrastructure may reveal additional related threats.