arc-claim[.]pages[.]dev

Analysis of arc-claim.pages.dev indicates a high-risk crypto-drainer operation that is currently active. The domain was registered on June 8 2026 through Cloudflare Pages, a service that provides free static-site hosting and automatically provisions SSL certificates. Google Safe Browsing classifies the site as a social-engineering threat, and three independent blocklists have already listed the domain as malicious.

VirusTotal reports that 11 of 91 scanned security engines flag the domain, confirming that multiple vendors have observed suspicious behavior. Additional defensive products, including PhishDestroy, MetaMask, and SEAL, have explicitly blocked access to the domain, suggesting that the site attempts to interact with cryptocurrency wallets or to lure users into authorizing malicious transactions. The available intelligence does not disclose the underlying hosting IP, page title, or any observed payload, so the exact method of credential or private-key harvesting remains uncertain.

Defenders should block the domain at network perimeter and DNS layers, monitor for any outbound connections to the associated Cloudflare Pages infrastructure, and alert users about the risk of unsolicited wallet interaction prompts. Incident response teams should also consider reviewing logs for any attempts to resolve or contact arc-claim.pages.dev, as early detection can prevent unauthorized crypto transfers. Ongoing surveillance is recommended to capture any evolution of the campaign, including potential changes to the hosting provider or the appearance of new indicators of compromise.