app[.]arbtirum[.]info

This domain, app.arbtirum.info, is flagged as a brand impersonation threat targeting Arbitrum, a Layer 2 scaling solution for Ethereum. Analysis indicates the site mimics the legitimate Arbitrum One bridge interface, likely functioning as a crypto wallet drainer designed to harvest private keys or seed phrases from unsuspecting users attempting to bridge assets. The page title, 'Bridge to Arbitrum One,' reinforces the deception by closely resembling the official Arbitrum branding and user experience. Infrastructure analysis reveals the following technical indicators: the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar often associated with high-risk domains. It resolves to IP address 172.67.215.200, a Cloudflare proxy endpoint that obscures the true origin server. The domain holds a Google Trust Services SSL certificate (WE1), which may lend a false sense of legitimacy to users. As of the latest scan, VirusTotal reports 2 out of 95 security vendors flagging the domain as malicious. It appears on one security blocklist, and Google Safe Browsing (GSB) does not currently list it as unsafe. The domain is currently offline, which may indicate takedown action or a temporary suspension by the hosting provider. Despite its inactive status, the risk remains elevated due to the potential for reactivation or migration to a new domain. Users who interacted with app.arbtirum.info should immediately revoke any connected wallet permissions, transfer assets to a new wallet, and monitor accounts for unauthorized transactions. Security teams are advised to block the domain and IP at the network level, and to monitor for newly registered lookalike domains using similar naming conventions or infrastructure patterns.