eth2[.]top

The domain eth2.top was registered on February 21, 2026 and is presently taken offline. Infrastructure analysis shows it resolves to the IP address 172.67.136.30, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site presented a page title of "Arbitrum Airdrop," directly targeting the Arbitrum brand and employing an airdrop‑style phishing kit. Reputation data indicates the domain is listed on two security blocklists and has been actively blocked by the PhishDestroy and ScamSniffer services.

VirusTotal scans report that two of ninety‑three security vendors flagged the domain, reinforcing the malicious classification. The SSL certificate is identified as "WE1," confirming that transport‑layer encryption was in place despite the fraudulent intent. The observed threat vector aligns with a crypto‑scam profile, specifically an impersonation of the Arbitrum brand to lure victims into a fraudulent airdrop claim.

While the site is no longer reachable, the combination of blocklist listings, vendor detections, and brand‑specific page title provides concrete evidence of malicious activity. Defenders should continue to monitor for any re‑registration of the domain or similar look‑alike URLs, enforce strict URL filtering for known malicious hosts, and educate users about unsolicited airdrop offers that reference Arbitrum. Additional scrutiny of any traffic to Cloudflare‑hosted IPs matching the same ASN may help identify related campaigns, and threat‑intel feeds should be updated to reflect the confirmed status of eth2.top as a brand‑impersonation crypto scam.