arcusfinance[.]net

This domain, arcusfinance.net, is flagged for brand impersonation targeting Solana, a decentralized blockchain platform. Analysis indicates the site masqueraded as an institutional-grade lending service under the title 'Arcus Finance — Institutional-Grade Lending on Solana,' a tactic designed to deceive users into disclosing wallet credentials or transferring assets to malicious smart contracts. No explicit drainer kit signatures were identified, but the infrastructure aligns with known phishing campaigns targeting cryptocurrency users, particularly those interacting with Solana-based DeFi protocols. Infrastructure analysis reveals the domain was registered on March 13, 2026, through NiceNIC International Group Co., Limited, an entity frequently associated with high-risk registrations. It resolved to the IP address 188.114.97.3, a Cloudflare-hosted endpoint leveraging HTTP/3 and Cloudflare Browser Insights for performance and evasion. At the time of assessment, the domain was detected by 5 out of 95 security vendors on VirusTotal and appeared on 3 distinct security blocklists. MetaMask, PhishDestroy, and SEAL had preemptively blocked access, though no Google Safe Browsing (GSB) classification was recorded. The domain has since been taken offline, likely due to enforcement actions or infrastructure takedowns. However, residual risk persists as threat actors may re-deploy the phishing kit under new domains or IPs. Users who interacted with the site prior to its removal should assume credential compromise and revoke any associated smart contract approvals. Organizations monitoring cryptocurrency threats are advised to track registrations under the same registrar and IP range for potential resurgence. No further malicious activity has been observed from this specific infrastructure post-takedown, but vigilance is warranted given the elevated risk profile.