arc-bridge-2qx[.]pages[.]dev

This domain operates as a fraudulent cryptocurrency bridge interface, specifically targeting users intending to transfer USDC across blockchains. Analysis indicates the page mimics legitimate crosschain services by presenting a deceptive interface labeled 'Arc Bridge — USDC Crosschain,' designed to harvest wallet credentials or private keys. The threat actor likely exploits trust in crosschain protocols to induce victims into connecting wallets, where malicious smart contracts or scripts may drain funds upon interaction. The domain remains a high-risk vector for cryptocurrency theft, with no legitimate use case identified. Infrastructure analysis reveals the domain was registered on June 04, 2026, through Cloudflare Pages, a platform often leveraged for rapid deployment of phishing pages. The SSL certificate, issued by Google Trust Services (WE1), provides a false sense of security while the domain resolves to the IP address 172.66.47.5. Detection metrics show limited but targeted coverage, with only 1 of 95 security vendors flagging the domain on VirusTotal, while three independent blocklists have listed it as malicious. The discrepancy between blocklist and vendor detection suggests a campaign optimized for evasion. Users who interacted with arc-bridge-2qx.pages.dev should immediately revoke any connected wallet permissions and transfer assets to a new, secure wallet address. All credentials entered on the site must be considered compromised, and any associated private keys should be treated as exposed. Monitoring for unauthorized transactions on linked accounts is critical, and affected users are advised to report the incident to relevant blockchain security teams for further mitigation. The domain remains active as of this analysis, underscoring the need for heightened scrutiny of crosschain service interfaces.