ethereum[.]sonic-game[.]live

Analysis of ethereum.sonic-game.live shows a short‑lived malicious infrastructure used to promote a bogus Arbitrum airdrop. The domain was registered on February 21, 2026 and immediately resolved to the IPv4 address 45.9.148.51, which is announced by AS49447 (Nice IT Services Group Inc.) and geolocated to the Netherlands. The site presented the page title “Claim Your Share of the Arbitrum Ecosystem | Up to $25,000 for Active Wallets,” a typical lure for crypto‑focused victims.

The SSL certificate is identified as R11, indicating a publicly trusted certificate but offering no additional legitimacy. Threat intelligence sources indicate the domain impersonates the brand “across,” and the scam type is classified as a “Fake Airdrop.” Security vendors on VirusTotal flagged the domain in 9 of 93 scans, and the site appears on a single external blocklist. PhishDestroy has already taken the domain offline, and the current status is reported as offline.

The elevated risk rating reflects the combination of brand impersonation, financial incentive, and the presence of a valid TLS certificate. Defenders should continue to block the resolved IP 45.9.148.51, add the fully qualified domain to local and network‑wide URL filtering lists, and monitor for any re‑registration attempts or similar sub‑domains that reuse the same hosting provider. Because the content of the page has not been captured, further forensic analysis of the page source could confirm the exact phishing vectors, but the existing indicators are sufficient to justify proactive containment and user‑awareness warnings about unsolicited Arbitrum airdrop claims.