artrum[.]click

This domain, artrum.click, is actively impersonating the Arbitrum blockchain platform as of July 12, 2026. Analysis indicates the site is designed to deceive users into believing it is an official Arbitrum portal, though no functional content is currently served. The domain resolves to 172.67.215.238, a Cloudflare-hosted IP under AS13335, and returns an HTTP 403 status with the page title 'Just a moment...'—a common Cloudflare interstitial that may mask malicious backend activity. Registration occurred on March 17, 2026, through Sav.com, LLC, with Cloudflare nameservers (braden.ns.cloudflare.com and jacqueline.ns.cloudflare.com) further obscuring direct infrastructure attribution. Security vendor detections provide partial confirmation of malicious intent: three out of ninety-five engines on VirusTotal flag the domain, while Gridinsoft assigns a trust score of 0/100. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, which specifically target brand impersonation threats. Technologies detected include Cloudflare Browser Insights and HTTP/3, consistent with modern phishing infrastructure leveraging CDN protections to evade takedowns. The 403 response suggests either a misconfigured or deliberately restricted frontend, potentially awaiting activation for a targeted campaign. What remains uncertain is the exact payload or attack vector. The domain may be staging for credential harvesting, fake token distributions, or wallet-draining schemes—common tactics in blockchain impersonation. Defenders should treat this domain as high-risk based on its registration pattern, brand targeting, and blocklist presence. Network-level blocking of 172.67.215.238 and artrum.click is recommended, along with monitoring for related subdomains or SSL certificate issuances under the same Cloudflare account. Given the domain’s four-month age and continued activity, it is unlikely to be abandoned, and further malicious content may emerge.