preprotocolsdataworker[.]com

Analysis of preprotocolsdataworker.com indicates that the domain is being used for a wallet/seed phishing campaign that impersonates the brand argent. The site presents the page title "Multisync-Secure – Just another WordPress site" and lacks an SSL certificate, suggesting that any data transmitted is unencrypted. The domain resolves to IP address 162.213.251.142, which is hosted in the United States under ASN 22612 owned by Namecheap, Inc. The registration record shows the domain was created on February 21, 2026 and was registered through NameCheap, Inc., using the authoritative nameservers dns1.namecheaphosting.com and dns2.namecheaphosting.com. Gridinsoft assigns the domain a trust score of 0 out of 100, reinforcing its malicious nature.

VirusTotal analysis reports that three of ninety‑five security vendors flagged the domain, and it is listed on four blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—demonstrating consensus among independent security services. The site is currently offline, but the infrastructure details remain valid for forensic correlation. Defenders should update their URL filtering to block the domain and its resolved IP, monitor for any future re‑hosting of the same infrastructure, and consider adding the domain to internal threat intel feeds.

Network sensors should watch for outbound connections to 162.213.251.142 and DNS queries for preprotocolsdataworker.com, as remnants of the campaign could be relaunched from similar Namecheap hosting environments. Because the site lacked TLS, any credentials or seed phrases entered would have been exposed in clear text, so organizations should advise users to change any argent‑related credentials that may have been submitted. Continuous monitoring of the listed blocklists and periodic re‑scans of the domain, should it reappear, are recommended to maintain situational awareness.