5fptrd4shebpfevicuwi3t2zw3spo64lzeohgscxye5t6cm67dvq[.]arweave[.]net

Analysis shows that the subdomain 5fptrd4shebpfevicuwi3t2zw3spo64lzeohgscxye5t6cm67dvq.arweave.net resolves to IP 212.102.56.179, a CDN77 node located in Frankfurt, Germany. The site presents a TLS certificate from Let’s Encrypt (E8) and returns HTTP 200 with the page title "Loading…", suggesting the content is dynamically generated or intentionally obscured. Registration data indicates the domain was created on 2026‑06‑08 through NameCheap, Inc., and its Gridinsoft trust score is 0 / 100, reinforcing the malicious assessment. Threat intelligence classifies the activity as brand impersonation generic phishing, and three of ninety‑one VirusTotal scanners have flagged the domain. The domain is already listed on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, confirming that security vendors have identified it as hostile. While the exact phishing payload and targeted brand are not disclosed in the available data, the combination of a recent registration, low trust score, and active blocklist presence indicates a high‑risk threat. Defenders should immediately deny outbound connections to the resolved IP, add the full domain to DNS and URL filtering policies, and monitor network logs for any attempts to reach the arweave.net subdomain. Continuous re‑evaluation is advised in case additional indicators, such as payload samples or victim reports, become available.