app[.]arbswap[.]guru

Analysis on 25 July 2026 shows that app.arbswap.guru is currently offline but was previously identified as a crypto‑related phishing operation. The site was classified as a Crypto Scam and was added to the PhishDestroy blocklist. VirusTotal recorded detections from 2 of 95 scanned security vendors, indicating that at least two scanners flagged the domain as malicious. The domain appears on one external blocklist, reinforcing its malicious reputation. No SSL certificate was observed, meaning the site operated without HTTPS encryption.

Infrastructure inspection reveals the domain resolves to IP address 104.21.35.12, which is owned by Cloudflare, Inc. (AS13335) and geolocated in the United States. The Gridinsoft trust score for the domain is 0 out of 100, reflecting an extremely low trust rating. Nameserver information is not available. Because the site is offline, active probing is not possible, and the absence of a certificate limits further TLS‑based analysis.

Defenders should ensure that the domain is added to DNS‑based blocklists and that any outbound traffic to the associated IP address is denied or closely monitored. Existing security products that reference VirusTotal detections should be updated to reflect the two positive detections. Continuous monitoring of Cloudflare‑hosted IP ranges for re‑use of the address is recommended, as threat actors frequently recycle cloud infrastructure. Until the domain is taken down permanently, organizations should treat any future resolution of app.arbswap.guru or related subdomains as high‑risk and enforce strict outbound filtering.