arc-block[.]info

This domain, arc-block.info, is flagged as a blockchain wallet drainer designed to impersonate ArcBlock, a legitimate decentralized application platform. Analysis indicates the site employs credential theft and automated fund exfiltration scripts to target cryptocurrency users, tricking them into connecting wallets under the guise of a trusted service. The threat actor likely exploits the ArcBlock brand to lower user suspicion, particularly among those familiar with blockchain infrastructure. Infrastructure analysis reveals multiple technical indicators supporting this assessment. The domain was registered on July 30, 2025, through NameSilo, LLC, and currently resolves to the IP address 172.67.153.239. It is flagged by 5 out of 95 security vendors on VirusTotal, while appearing on two independent security blocklists. The site uses Cloudflare for hosting and Google Trust Services for SSL certification, a common tactic to mimic legitimacy. The page title, 'Welcome to ArcBlock!', further reinforces the brand impersonation strategy. Users who visited arc-block.info should immediately revoke any wallet permissions granted to the site and transfer assets to a new, secure wallet. Monitor transaction histories for unauthorized activity, particularly small test transactions that may precede larger fund transfers. If credentials were entered, reset passwords for all associated accounts and enable multi-factor authentication where available. Given the domain’s use of Cloudflare and HTTP/3, traditional network-based blocking may be insufficient; endpoint protection and browser-based wallet security extensions are recommended for future mitigation.