arbiscan-com[.]webflow[.]io

Analysis indicates that arbiscan-com.webflow.io is a high‑risk brand‑impersonation site targeting users of the Arbitrum ecosystem. The domain was created on May 08, 2013 and is registered through MarkMonitor, Inc., a registrar commonly associated with legitimate brand assets, which may lend the site an appearance of legitimacy. DNS resolution points to 172.64.151.8, an address owned by Cloudflare, Inc. (AS13335) and the domain uses Cloudflare’s infrastructure, including HTTP/3 support. The SSL certificate is issued by Google Trust Services under the WE1 designation, providing a valid HTTPS handshake that could further obscure malicious intent.

The page title returned by the server is "Arbiscan - Arbitrum L2 Explorer," mirroring the naming convention of the genuine Arbiscan service and reinforcing the impersonation narrative. Google Safe Browsing has flagged the site for social engineering, and PhishDestroy has confirmed it as blocked. VirusTotal reports that 13 of 95 security vendors have flagged the domain, and it appears on one external blocklist, reinforcing its malicious classification.

The site currently returns HTTP 404 and is listed as offline, suggesting that the phishing content may have been removed or the operator has ceased activity. Defenders should continue to block the domain at network perimeter and DNS filtering layers, monitor for any resurgence of content, and consider adding the IP address 172.64.151.8 to threat‑intel feeds if not already present. Ongoing vigilance is advised given the use of reputable infrastructure and a valid certificate, which can facilitate future re‑use of the same host for similar brand‑impersonation campaigns.