# PhishDestroy threat dossier — fatty-access-claim.arribate.live ================================================================ Fetched: 2026-04-30 23:56:39 UTC Canonical: https://phishdestroy.io/domain/fatty-access-claim.arribate.live/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Fake Exchange Targeted brand: Investment Scam ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 2/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, Gridinsoft Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 104.21.86.186 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: Cloudflare, Inc. Registrar: Spaceship, Inc. Nameservers: ["sydney.ns.cloudflare.com", "archer.ns.cloudflare.com"] Registered: 2026-04-26 Page title: FatBot, the greatest crypto trading platform! HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / E8 Expires: 2026-06-10 Status: INVALID chain Fingerprint: da7b72fa22185c92333c3c583c1a695d4af05960c17d4975f4c06674d73ffd37 Subject Alternative Names (related infrastructure — often same operator): - arribate.live ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-26 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-26 16:05:42 UTC (by PhishDestroy tracker) Last verified: 2026-04-28 19:40:24 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019dc9e3-b707-75dc-b6f9-5103cda6fa0c/ Wayback Machine: https://web.archive.org/web/*/fatty-access-claim.arribate.live crt.sh CT logs: https://crt.sh/?q=%25.fatty-access-claim.arribate.live Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=fatty-access-claim.arribate.live AlienVault OTX: https://otx.alienvault.com/indicator/domain/fatty-access-claim.arribate.live URLhaus: https://urlhaus.abuse.ch/host/fatty-access-claim.arribate.live/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-26 16:08:07 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies fatty-access-claim.arribate.live as an active cryptocurrency drainer domain distributing malicious payloads to steal digital assets from unsuspecting victims. This domain employs sophisticated social engineering tactics to mimic legitimate crypto platforms, specifically targeting users through deceptive wallet connection requests designed to drain funds without authorization. The threat actor behind this infrastructure operates with clear malicious intent, leveraging domain spoofing combined with cryptocurrency theft mechanics to execute high-yield fraud schemes targeting the Web3 ecosystem. This domain presents multiple red flags confirmed by independent security research. fatty-access-claim.arribate.live shows 0 detections out of 95 VirusTotal scans, indicating it has evaded initial detection by major antivirus engines. The domain resolves to IP address 104.21.86.186 and utilizes a Let's Encrypt SSL certificate to establish false credibility. Security researchers at ScamSniffer have already flagged this domain as malicious, placing it on their active blocklist. While the exact creation date remains unverified, the domain's association with known crypto-draining infrastructure through unique seed identifier 82a8f5 suggests recent deployment designed to capitalize on current market activity and user trust patterns. Cryptocurrency drainer domains like fatty-access-claim.arribate.live represent an advanced persistent threat that requires immediate attention from both individual users and organizational security teams. These attacks typically begin with phishing emails, social media messages, or fake NFT airdrops that prompt victims to connect their wallets to malicious websites. Once connected, smart contract approvals grant attackers unlimited spending permissions on victim assets. Users should immediately revoke any suspicious wallet approvals using tools like revoke.cash or similar blockchain security platforms. Organizations should implement wallet connection monitoring policies and deploy blockchain transaction analysis tools to detect unauthorized transfers. Never connect wallets to unknown domains, verify website authenticity through multiple independent sources, and use hardware wallets for high-value transactions to minimize exposure to crypto drainer attacks. [Updates since narrative was generated:] - WHOIS creation date: 2026-04-26 ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: c3becaa9b7955aca164e75d189a67a69 TLS cert SHA-256: da7b72fa22185c92333c3c583c1a695d4af05960c17d4975f4c06674d73ffd37 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/fatty-access-claim.arribate.live/ JSON API: https://api.destroy.tools/v1/check?domain=fatty-access-claim.arribate.live Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io