claim-arc[.]xyz

This domain, claim-arc.xyz, poses as an official Etherscan token upgrade portal to deceive cryptocurrency users into connecting their wallets. The site displays a fraudulent "ARC Token Upgrade" page, claiming users must migrate from ARC v1 to ARC v2. In reality, the page is designed to execute a crypto drainer attack, siphoning funds from victims' wallets once they authorize malicious transactions through the interface. The threat specifically targets users familiar with Ethereum-based tokens and decentralized finance platforms, exploiting trust in the Etherscan brand to facilitate unauthorized asset transfers. Analysis indicates the domain was registered on August 30, 2025, through OwnRegistrar, Inc., a registrar previously associated with high volumes of malicious domains. Infrastructure analysis reveals the site resolves to 188.114.97.3, an IP address hosted on Cloudflare's network (AS13335). Detection metrics show 11 out of 95 security vendors on VirusTotal flag the domain as malicious, while two independent blocklists—PhishDestroy and ScamSniffer—have already classified it as a confirmed phishing resource. The SSL certificate (WE1) further suggests automated or low-effort deployment, common in large-scale phishing operations. Users who visited claim-arc.xyz and interacted with the site should immediately revoke any wallet permissions granted through the interface. This can be done via blockchain explorers or wallet management tools by reviewing and removing suspicious smart contract authorizations. Affected individuals should also transfer remaining assets to a new, secure wallet and monitor their transaction history for unauthorized activity. If funds were lost, victims should report the incident to their local cybercrime authority and provide the domain, IP address, and transaction hashes for further investigation. Proactive measures, such as enabling transaction simulation tools and verifying domain authenticity through official channels, can reduce future exposure to similar threats.