mail[.]arciumcoin[.]network

Analysis of mail.arciumcoin.network shows an active infrastructure supporting a generic phishing campaign. The domain is registered through Sav.com, LLC and carries a Gridinsoft trust score of 0/100, indicating a complete lack of legitimacy. The site returns HTTP 200 responses, which allows the malicious page to be served without immediate error signals. Technical resolution points to IP address 144.172.112.30, hosted in the United States and assigned to AS14956 (RouterHosting LLC). The host uses Cloudflare DNS, specifically cris.ns.cloudflare.com and rayne.ns.cloudflare.com, providing typical CDN protection and obscuring the true origin server. An up‑to‑date Let’s Encrypt certificate (YR1) encrypts traffic, a common tactic for phishing sites to appear trustworthy. Threat intelligence flags the domain on a single security blocklist, where it is listed by PhishDestroy, and five of ninety‑five VirusTotal scanners have raised detections. Combined with the zero trust score and the high risk rating, these indicators reinforce the conclusion that mail.arciumcoin.network is being leveraged to harvest credentials or financial information, likely masquerading as legitimate communications from the ArciumCoin project. Defenders should immediately block DNS resolution to mail.arciumcoin.network and consider sinkholing the associated IP address 144.172.112.30. Email gateways ought to be updated with the domain in deny lists, and intrusion detection signatures should be tuned to flag outbound connections to the identified Cloudflare nameservers when paired with the specific IP. Continuous monitoring for newly registered subdomains under arciumcoin.network is advised, as the operators may replicate this infrastructure using the same hosting provider and certificate authority.