# PhishDestroy domain threat record: arbdiex.run

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/arbdiex.run/
Machine-readable companion: https://phishdestroy.io/domain/arbdiex.run/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-20 22:41:34 UTC
- Last availability or vendor check: 2026-10-22 10:59:50 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Arbitrum

## Stored infrastructure

- Observed IP address: 188.114.97.3
- Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED
- Last stored HTTP status: 200
- Registration date (registry RDAP, arbdiex.run): 2026-10-15 17:35:13 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a15b78-e438-75dd-be58-b0c7d81e8faf/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/arbdiex.run
- Certificate Transparency search: https://crt.sh/?q=%25.arbdiex.run
- Web Archive lookup: https://web.archive.org/web/*/https://arbdiex.run/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s automated assessment classifies arbdiex.run as an impersonation phishing page. The page’s recorded title is “Arbidex on Arbitrum: Swaps and Liquidity”. The domain was first seen by PhishDestroy on 2026-10-21.

How the scam works
Impersonation phishing pages copy the look and language of a trusted brand to lure users into entering login credentials, private keys or other sensitive data. Victims who submit such information may have their accounts compromised or funds diverted.

Evidence
VirusTotal scanned the site on 2026-10-21 with 92 engines and reported zero detections. Google Safe Browsing checked the URL on 2026-10-21 and did not flag it. External blocklists MetaMask and SEAL listed the domain on 2026-10-21, and PhishDestroy’s internal blocklist also includes it as of that date. OTX recorded four pulses referencing the domain on 2026-10-21.

Infrastructure
The domain was registered on 2026-10-15 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The recorded hosting IP is 188.114.97.3, and the domain was observed six days after registration.

What to do
Users should avoid entering any Arbitrum‑related credentials or approvals on this site and monitor their accounts for unexpected activity. Defenders should block arbdiex.run at the network perimeter and review any access logs for connections to the recorded IP.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a15b78-e438-75dd-be58-b0c7d81e8faf/
VirusTotal report: https://www.virustotal.com/gui/domain/arbdiex.run
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=arbdiex.run
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-20 23:13:23 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/MDXCBB0n/eb8296866e5d.png
  Captured: 2026-10-20 22:41:34 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a15b78-e438-75dd-be58-b0c7d81e8faf.png
  Captured: 2026-10-20 22:41:34 UTC
  Source report: https://urlscan.io/result/01a15b78-e438-75dd-be58-b0c7d81e8faf/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/3aadfcf3-972e-45d8-b5dd-bc30d9b8f179.png
  Captured: 2026-10-20 23:12:18 UTC
  Source report: https://radar.cloudflare.com/scan/3aadfcf3-972e-45d8-b5dd-bc30d9b8f179
  SHA-256: 4ad4ed3e97abc3e7395f8e613df85df8c574341bd98c9af7405e8d8fd2556a0d
- URLQuery: https://screenshots.phishdestroy.io/uq/51d6c98a-6bcd-4ead-b965-a20fe9519570.png
  Source report: https://urlquery.net/report/51d6c98a-6bcd-4ead-b965-a20fe9519570
  SHA-256: 1f4ba1ce7b1849a5d8928aa8b47353e8d8ae6cd3d8349dac3b94ca98abac3728

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T23:43:31Z",
        "uuid": "01a15b78-e438-75dd-be58-b0c7d81e8faf",
        "scanned_at": "2026-10-20T22:40:20Z",
        "final_url": "https://arbdiex.run/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://arbdiex.run/",
                "from": "http://arbdiex.run/",
                "status": 307
            }
        ],
        "ip": "104.21.30.62",
        "domains": [
            "static.cloudflareinsights.com"
        ],
        "ips": [
            "104.16.80.73",
            "104.21.30.62"
        ],
        "asns": [
            "13335"
        ],
        "doc_hash": "ea028d0463edba4c874c685fcc83d135112c1b3d09577e9a124adbd00ff4982c",
        "globals": [
            "__cfBeacon"
        ],
        "tls": {
            "san": [
                "*.arbdiex.run",
                "arbdiex.run"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "arbdiex.run",
            "protocol": "QUIC",
            "valid_to": "2027-01-13T16:50:09Z",
            "valid_from": "2026-10-15T16:50:10Z"
        },
        "domain_age_days": 4,
        "apex_age_days": 4,
        "tls_age_days": 5,
        "tls_valid_days": 89,
        "requests": 8,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 97,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=UTF-8",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin-when-cross-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T00:21:17Z",
        "uuid": "3aadfcf3-972e-45d8-b5dd-bc30d9b8f179",
        "scanned_at": "2026-10-20T23:12:18Z",
        "final_url": "https://arbdiex.run/",
        "status": 200,
        "history": [
            {
                "url": "https://arbdiex.run/",
                "status": 200
            }
        ],
        "dom_hash": "9a02dab4a6506bb292cfa798e597c0c8196f61412121a36cae9314120f96525c",
        "doc_hash": "ea028d0463edba4c874c685fcc83d135112c1b3d09577e9a124adbd00ff4982c",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "arbdiex.run",
                "type": "A",
                "value": "104.21.30.62"
            },
            {
                "name": "arbdiex.run",
                "type": "A",
                "value": "172.67.172.50"
            },
            {
                "name": "arbdiex.run",
                "type": "AAAA",
                "value": "2606:4700:3032::6815:1e3e"
            },
            {
                "name": "arbdiex.run",
                "type": "AAAA",
                "value": "2606:4700:3035::ac43:ac32"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.30.62",
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "created": "2026-10-15T17:35:13Z",
            "updated": "2026-10-15T17:35:29Z",
            "expires": "2027-10-15T17:35:13Z",
            "nameservers": [
                "josh.ns.cloudflare.com",
                "lana.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T00:27:47Z",
        "analysis_at": "2026-10-20T23:05:30Z",
        "stats": {
            "timeout": 0,
            "harmless": 0,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 92
        },
        "reputation": 0,
        "first_seen": "2026-10-15T19:16:20Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "josh.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::6815:1e3e"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "josh.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.172.50"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.30.62"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3035::ac43:ac32"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "lana.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-20T23:10:44Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.arbdiex.run",
                "arbdiex.run"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "644c99b9604e1019c37312bb5148fdaee7d",
            "sha256": "65c29734317f98b44649ad6d809983384fb03cc6c4c0b0717b2056aa3a9d7c61",
            "subject": "arbdiex.run",
            "valid_to": "2027-01-13T16:50:09Z",
            "valid_from": "2026-10-15T16:50:10Z"
        },
        "rdap": {
            "status": [
                "client delete prohibited",
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-10-15T16:00:00Z",
                "registration": "2026-10-15T16:00:00Z",
                "registrar expiration": "2027-10-15T16:00:00Z",
                "last update of RDAP database": "2026-10-15T16:00:00Z"
            },
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "registrar_iana_id": "3765"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-21T01:24:17Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "arbdiex.run"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-20T22:43:31Z",
            "first": "2026-10-16T02:14:21Z",
            "changes": 1,
            "days_archived": 2,
            "scans_per_day": 0.21,
            "avg_page_bytes": 4172
        },
        "robots_txt": {
            "present": true,
            "sitemaps": [
                "https://arbdiex.run/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 5
        },
        "social_tags": {
            "ogUrl": "https://arbdiex.run/",
            "title": "Arbidex on Arbitrum: Swaps and Liquidity",
            "ogType": "website",
            "robots": "all",
            "ogImage": "https://arbdiex.run/public/pictures/neutral-workflow-1.png",
            "ogTitle": "Arbidex on Arbitrum: Swaps and Liquidity",
            "ogSiteName": "Arbidex",
            "themeColor": "#eeecee",
            "description": "Arbidex, an Arbitrum DEX for swaps, liquidity and staking, uses Classic Zaps to balance single-token deposits before adding liquidity.",
            "twitterCard": "summary_large_image",
            "canonicalUrl": "https://arbdiex.run/",
            "ogDescription": "Arbidex, an Arbitrum DEX for swaps, liquidity and staking, uses Classic Zaps to balance single-token deposits before adding liquidity."
        },
        "trackers": {
            "requests": 4
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 322,
                "tls": 85,
                "wait": 84,
                "connect": 7,
                "download": 9
            },
            "response_ms": 507
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 18514,
            "co2_grams": 0.0007,
            "cleaner_than": 58
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.32.182",
                    "host": "lana.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.33.126",
                    "host": "josh.ns.cloudflare.com"
                }
            ],
            "zone": "arbdiex.run"
        },
        "location": {
            "ip": "2a06:98c1:3121::9",
            "asn": "13335",
            "org": "CloudFLARENET-EU",
            "city": "London",
            "country": "GB"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "arbdiex.run"
        },
        "dns": {
            "A": [
                "188.114.96.9",
                "188.114.97.9"
            ],
            "NS": [
                "lana.ns.cloudflare.com",
                "josh.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"josh.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2417621816, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2a06:98c1:3121::9",
                "2a06:98c1:3120::9"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": "strict-origin-when-cross-origin",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3120::9",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://arbdiex.run"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Cloudflare",
                "Open Graph",
                "HTTP/3"
            ]
        },
        "linked_pages": {
            "internal_count": 18
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=UTF-8",
                "x-content-type-options": "nosniff",
                "referrer-policy": "strict-origin-when-cross-origin"
            }
        }
    }
}
```