owltofinance[.]aguemma60[.]workers[.]dev

The domain owltofinance.aguemma60.workers.dev has been identified as a high-risk brand impersonation threat targeting the Arbitrum brand. There is no indication that this domain is associated with any known crypto drainer kit; however, its potential for misuse is significant given its impersonation of a recognized brand in the crypto space.

Technical indicators reveal that this domain was created on February 21, 2026, and is currently registered through Cloudflare, Inc. The domain resolves to the IP address 104.21.3.45, which is located in the US and belongs to AS13335 Cloudflare, Inc. Security analysis shows that the domain appears on one security blocklist and has a VirusTotal score of 2 out of 95, indicating that it has been flagged by two security vendors. It is also noted that the domain is currently blocked by PhishDestroy, contributing to its risk profile.

The current status of the domain is active, posing a potential risk to users who may encounter it. Response actions should include continuous monitoring of the domain’s activity and immediate reporting of any phishing attempts targeting users. Organizations and individuals are advised to exercise caution and implement stringent security measures to avoid falling victim to this brand impersonation threat. Users should be vigilant when interacting with unsolicited communications related to the Arbitrum brand.