# PhishDestroy domain threat record: arguspad.io

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/arguspad.io/
Machine-readable companion: https://phishdestroy.io/domain/arguspad.io/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-16 00:26:13 UTC
- Last availability or vendor check: 2026-10-23 10:35:36 UTC
- Stored record updated: 2026-10-23 18:20:38 UTC
- VirusTotal detections in the stored snapshot: 4/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: curve

## Stored infrastructure

- Observed IP address: 69.46.46.111
- Registrar in stored WHOIS data: NameCheap, Inc.
- Last stored HTTP status: 307
- Registration date (registry RDAP, arguspad.io): 2026-09-03 05:43:30 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a094ca-4548-765a-9c27-7345b159f53c/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/arguspad.io
- Certificate Transparency search: https://crt.sh/?q=%25.arguspad.io
- Web Archive lookup: https://web.archive.org/web/*/https://arguspad.io/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
arguspad.io is a live crypto drainer site that presents itself under the "Argus" brand, as indicated by its page title "Explore - Argus". PhishDestroy first identified it on 2026-10-16, and as of 2026-10-18 the site remains fully reachable and active. It targets cryptocurrency holders, luring them into interacting with what appears to be a legitimate Web3 platform.

How the scam works
Wallet drainers work by prompting visitors to connect their crypto wallets, then requesting token approvals or signing malicious transactions that silently transfer assets to attacker-controlled addresses. The "Explore" framing suggests the site poses as a discovery or marketplace platform, a common lure designed to make wallet connection feel routine and safe. Once a victim approves a transaction, funds or NFTs can be swept instantly and irreversibly.

Evidence
At the time of checking on 2026-10-16, zero of 92 antivirus engines on VirusTotal flagged arguspad.io, meaning it evades automated security tooling entirely. Despite this, the domain appears in 2 OTX threat intelligence pulses, providing independent corroboration of malicious activity. PhishDestroy is currently the sole blocklist carrying this domain. The low detection rate underscores how freshly deployed drainer infrastructure routinely bypasses conventional scanners.

Infrastructure
The site is hosted on IP 69.46.46.111 within the Railway cloud network based in the United States, a platform-as-a-service provider that makes rapid deployment easy. TLS is provided by Let's Encrypt under the YR2 intermediate, giving the site a padlock that lends false legitimacy. No registration date or registrar data is available in the current record.

What to do
If you visited arguspad.io but did not connect a wallet, no immediate action is required beyond avoiding the site. If you connected a wallet, immediately revoke all token approvals granted to any contracts associated with this site using a trusted approval-management tool, then transfer remaining assets to a fresh wallet address. If you signed a transaction, assume affected tokens and NFTs are lost and report the incident to your wallet provider. Security teams and platform defenders should block 69.46.46.111 and add arguspad.io to DNS and proxy blocklists without delay.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a094ca-4548-765a-9c27-7345b159f53c/
VirusTotal report: https://www.virustotal.com/gui/domain/arguspad.io
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=arguspad.io
Archived copy: https://web.archive.org/web/20261016002734/https://arguspad.io/
Revoke token approvals: https://revoke.cash/
Report crypto fraud (Chainabuse): https://www.chainabuse.com/report
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-18 21:08:24 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a094ca-4548-765a-9c27-7345b159f53c.png
  Captured: 2026-10-16 00:26:13 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a094ca-4548-765a-9c27-7345b159f53c.png
  Captured: 2026-10-16 03:30:22 UTC
  Source report: https://urlscan.io/result/01a094ca-4548-765a-9c27-7345b159f53c/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/24e0edaa-fdb3-4a03-b2b7-94bd2f3a45ed.png
  Captured: 2026-10-16 00:27:18 UTC
  Source report: https://radar.cloudflare.com/scan/24e0edaa-fdb3-4a03-b2b7-94bd2f3a45ed
  SHA-256: 28b3bb8cdb60f39f9375c1aa3eea0ab6e65c412429720aa397255e3c5938aee4
- URLScan · 2026-09-12: https://screenshots.phishdestroy.io/us/01a094ca-4c86-77a4-b09a-761a0828f8b7.png
  Captured: 2026-09-12 08:44:49 UTC
  Source report: https://urlscan.io/result/01a094ca-4c86-77a4-b09a-761a0828f8b7/
  SHA-256: 4f8cdf21c7e60918cc8ae1d361756165a40cdcedf5cdc23ef39ffc18802a5be3
- URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a14220-b022-77fa-a3e0-c8355df2fb30.png
  Captured: 2026-10-16 00:33:31 UTC
  Source report: https://urlscan.io/result/01a14220-b022-77fa-a3e0-c8355df2fb30/
  SHA-256: a90949428e8d295af70dbb4427c72c0d910156d10e4f01ad5e0a586062f1b5cc

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T17:46:42Z",
        "uuid": "01a094ca-4548-765a-9c27-7345b159f53c",
        "scanned_at": "2026-09-12T08:44:49Z",
        "final_url": "https://arguspad.io/",
        "status": 200,
        "ip": "69.46.46.111",
        "domains": [
            "www.google-analytics.com",
            "files.catbox.moe",
            "www.googletagmanager.com"
        ],
        "ips": [
            "142.251.20.100",
            "108.181.20.35",
            "142.251.110.97",
            "69.46.46.111"
        ],
        "asns": [
            "15169",
            "40676",
            "400940"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "x.com",
            "t.me"
        ],
        "social": [
            "https://x.com/arguspad",
            "https://t.me/argus_arc"
        ],
        "doc_hash": "11e3bede6a73b8f767317d32946d9545c70f01254f4ea57ed8c092f00956126e",
        "script_hashes": [
            "a10568306b34908511b49eb596785512026fba4f2d605bd6406696b9fd767c74",
            "6f7927041946fafd1fabaaa08dc3bc1deab43dbcadc09584ba7f578ca097e745",
            "492ded360ce7984b7d21966191acc0d8deec6a9a34e5989f1b0b7190f9ffa664",
            "f224881e90569c081c118150769de7eb03028af5f7b990badec9d9cf602ad693",
            "e75e075f8a82b6a8d7473a569e973ace9ab239d9c24f9614d4a31c3a4c8818af",
            "b56d235815149748461c707e39747bd93b565b45fcbd59f0d14b82fe96be249e",
            "410e6176219eae627e18e34abffa1037b92c92777ee048539a5a605ed6740fb4",
            "5517b58db8484ff43ed3713decd02306956d7255fabd1c2a91421ed2d7f6171c",
            "1ae11dc939a3333624a853422bb2b4903ad240c9d658e62dd02686820cc2ed2d",
            "932e33a2d78e4d190fcb54ac91da84710b38589695b18679a4aa6b11192c3749"
        ],
        "globals": [
            "__next_f",
            "TURBOPACK",
            "next",
            "__webpack_hash__",
            "gtag",
            "dataLayer",
            "google_tag_data",
            "google_tag_manager",
            "onYouTubeIframeAPIReady",
            "gaGlobal"
        ],
        "cookies": [
            "_ga_H19SYPK54B",
            "_ga"
        ],
        "tls": {
            "san": [
                "arguspad.io"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR2",
            "subject": "arguspad.io",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-06T20:17:42Z",
            "valid_from": "2026-09-07T20:17:43Z"
        },
        "domain_age_days": 4,
        "apex_age_days": 4,
        "tls_age_days": 4,
        "tls_valid_days": 89,
        "requests": 78,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 96,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "railway-hikari",
            "content-type": "text/html; charset=utf-8",
            "x-powered-by": "Next.js"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T17:59:36Z",
        "uuid": "24e0edaa-fdb3-4a03-b2b7-94bd2f3a45ed",
        "scanned_at": "2026-10-16T00:27:18Z",
        "final_url": "https://arguspad.io/",
        "status": 200,
        "history": [
            {
                "url": "https://arguspad.io/",
                "status": 200
            }
        ],
        "dom_hash": "b6b51227c2fa1c1d912aa218772cdb314f240d1a89251b230087d0598c4bdbff",
        "doc_hash": "516d68656407231671e16cc5b292d9cc43f9524d5b89a7f2144397050d3f0f44",
        "domain_risks": [
            "Brokerage & Investing",
            "Business & Economy"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "arguspad.io",
                "type": "CNAME",
                "value": "rhq4t06x.up.railway.app"
            },
            {
                "name": "arguspad.io",
                "type": "CNAME",
                "value": "rhq4t06x.up.railway.app"
            }
        ],
        "dnssec_valid": false,
        "ip": "69.46.46.111",
        "whois": {
            "registrar": "NameCheap, Inc.",
            "created": "2026-09-03T05:43:30Z",
            "updated": "2026-09-16T12:08:48Z",
            "expires": "2027-09-03T05:43:30Z",
            "nameservers": [
                "dns1.registrar-servers.com",
                "dns2.registrar-servers.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-20T19:46:35Z",
        "analysis_at": "2026-10-19T02:00:06Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 3,
            "suspicious": 1,
            "undetected": 35
        },
        "detections": {
            "CRDF": "malicious",
            "SOCRadar": "suspicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "BitDefender": "financial",
            "alphaMountain.ai": "Phishing, Newly Registered (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "phishing and other frauds"
        },
        "registrar": "NAMECHEAP INC",
        "created": "2026-09-03T05:43:30Z",
        "expires": "2027-09-03T05:43:30Z",
        "updated": "2026-09-16T12:08:48Z",
        "first_seen": "2026-09-07T21:30:41Z",
        "dns": [
            {
                "ttl": 3601,
                "type": "SOA",
                "rname": "hostmaster.registrar-servers.com",
                "value": "dns1.registrar-servers.com"
            },
            {
                "ttl": 1800,
                "type": "TXT",
                "value": "v=spf1 include:spf.efwd.registrar-servers.com ~all"
            },
            {
                "ttl": 1798,
                "type": "CNAME",
                "value": "rhq4t06x.up.railway.app"
            },
            {
                "ttl": 1799,
                "type": "CNAME",
                "value": "rhq4t06x.up.railway.app"
            },
            {
                "ttl": 60,
                "type": "A",
                "value": "69.46.46.111"
            }
        ],
        "dns_at": "2026-10-19T02:00:29Z",
        "jarm": "29d3fd00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3ae",
        "cert": {
            "san": [
                "arguspad.io"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "6dea369237902f47c97053084b6a77d3b4e",
            "sha256": "c79a39760c023b344d87ec21109f8351fc4e168476ce6a032a7d02850bdca084",
            "subject": "arguspad.io",
            "valid_to": "2026-12-06T20:17:42Z",
            "valid_from": "2026-09-07T20:17:43Z"
        },
        "whois": {
            "registrar": "NAMECHEAP INC",
            "registrar_iana_id": "1068",
            "registrar_url": "http://www.namecheap.com",
            "created": "2026-09-03T05:43:30Z",
            "updated": "1-01-01T00:00:00Z",
            "expires": "2027-09-03T05:43:30Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "dns1.registrar-servers.com",
                "dns2.registrar-servers.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "registration": "2026-09-03T05:43:30Z",
                "registrar expiration": "2027-09-03T05:43:30Z",
                "last update of RDAP database": "2026-10-19T02:00:19Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-23T18:53:21Z",
        "mail_config": {
            "mx": [
                "eforward4.registrar-servers.com",
                "eforward5.registrar-servers.com",
                "eforward1.registrar-servers.com",
                "eforward2.registrar-servers.com",
                "eforward3.registrar-servers.com"
            ],
            "spf": "v=spf1 include:spf.efwd.registrar-servers.com ~all",
            "spf_lookups": 1
        },
        "caa_records": {
            "domain": "arguspad.io"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-17T11:22:46Z",
            "first": "2026-09-29T23:56:04Z",
            "changes": 3,
            "days_archived": 4,
            "scans_per_day": 0.17,
            "avg_page_bytes": 2874
        },
        "robots_txt": {
            "present": true,
            "sitemaps": [
                "https://argus.world/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 5000
        },
        "social_tags": {
            "ogUrl": "https://argus.world",
            "title": "Token launchpad on Arc | Argus",
            "ogType": "website",
            "robots": "index, follow, max-image-preview:large",
            "ogImage": "https://argus.world/brand/social-banner.png",
            "ogTitle": "Token launchpad on Arc | Argus",
            "ogSiteName": "Argus",
            "description": "Argus is a permissionless token launchpad on Arc. Tax splits to the creator, buyback, liquidity and holders from the first trade. Every parameter is fixed at launch.",
            "twitterCard": "summary_large_image",
            "twitterSite": "@arguspad",
            "canonicalUrl": "https://argus.world",
            "ogDescription": "Argus is a permissionless token launchpad on Arc. Tax splits to the creator, buyback, liquidity and holders from the first trade. Every parameter is fixed at launch.",
            "twitterCreator": "@arguspad"
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 307,
            "timings": {
                "dns": 146,
                "tls": 14,
                "wait": 122,
                "connect": 14,
                "download": 0
            },
            "response_ms": 296
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 489979,
            "co2_grams": 0.0179,
            "cleaner_than": 1
        },
        "location": {
            "ip": "69.46.46.111",
            "asn": "400940",
            "org": "Railway",
            "city": "Seattle",
            "country": "US"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR2",
            "subject": "arguspad.io"
        },
        "dns": {
            "A": [
                "69.46.46.111"
            ],
            "MX": [
                "{\"exchange\": \"eforward3.registrar-servers.com\", \"priority\": 10}",
                "{\"exchange\": \"eforward5.registrar-servers.com\", \"priority\": 20}",
                "{\"exchange\": \"eforward4.registrar-servers.com\", \"priority\": 15}",
                "{\"exchange\": \"eforward2.registrar-servers.com\", \"priority\": 10}",
                "{\"exchange\": \"eforward1.registrar-servers.com\", \"priority\": 10}"
            ],
            "TXT": [
                "v=spf1 include:spf.efwd.registrar-servers.com ~all"
            ],
            "CNAME": [
                "rhq4t06x.up.railway.app"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": true
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": "DENY",
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": "default-src 'self'; script-src 'self' 'unsafe-inline' https://www.googletagmanager.com; style-src 'self' 'unsafe-inline'",
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "69.46.46.111",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://arguspad.io",
                "https://argus.world"
            ],
            "count": 1
        },
        "social_presence": {
            "profiles": [
                "https://x.com/arguspad"
            ]
        },
        "linked_pages": {
            "external": [
                "https://x.com/arguspad",
                "https://t.me/argus_arc"
            ],
            "external_count": 2,
            "internal_count": 66
        },
        "whois": {
            "registrar": "NameCheap, Inc.",
            "created": "2026-09-03T05:43:30Z",
            "updated": "2026-09-16T12:08:48Z",
            "expires": "2027-09-03T05:43:30Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "dns1.registrar-servers.com",
                "dns2.registrar-servers.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "railway-hikari",
                "content-type": "text/html; charset=utf-8",
                "content-security-policy": "default-src 'self'; script-src 'self' 'unsafe-inline' https://www.googletagmanager.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' https://fonts.reown.com; connect-src 'self' https://api.web3modal.org wss://relay.walletconnect.org https://rpc.walletconnect.o",
                "x-frame-options": "DENY"
            }
        }
    }
}
```