heymintgate[.]com

This domain, heymintgate.com, is actively impersonating the Arbitrum brand and has been classified as a high-risk threat. Registered on December 7, 2025, through NiceNIC International Group Co., Limited, the domain resolves to the IP address 188.114.97.3. Infrastructure analysis reveals the use of Cloudflare and HTTP/3, which are commonly employed to obfuscate malicious activity and enhance delivery speed. The domain's SSL certificate is issued by Google Trust Services, a legitimate provider often exploited to lend credibility to fraudulent sites. The domain has been flagged by 5 out of 95 security vendors on VirusTotal, indicating a moderate level of detection but not yet widespread recognition as malicious. It appears on three security blocklists, including PhishDestroy, OISD, and BLP-Malware, further corroborating its suspicious nature. AlienVault OTX records show the domain in 28 threat intelligence pulses, suggesting it has been linked to multiple malicious campaigns. The page title, 'HeyMint,' does not align with the known branding of Arbitrum, which may indicate an attempt to mislead users or divert attention from the impersonation. While the exact content of the site has not been analyzed, the combination of brand impersonation, low trust scores (Gridinsoft trust score of 0/100), and presence on multiple blocklists strongly suggests malicious intent. Defenders should treat this domain as an active threat and consider blocking it at the network level. Monitoring for related domains registered through the same registrar or resolving to the same IP may help identify additional threats. Given the domain's recent creation and continued activity, organizations should prioritize reviewing logs for connections to 188.114.97.3 or interactions with heymintgate.com to assess potential compromise.