arichian[.]xyz

Analysis on arichian.xyz shows a short‑lived cryptocurrency‑focused phishing operation. The domain was registered on 06 Nov 2025 through NiceNIC International Group Co., Limited and is hosted on Cloudflare’s network (AS13335) with the IPv4 address 188.114.96.3 located in the United States. DNS resolution uses the Cloudflare name servers amit.ns.cloudflare.com and michelle.ns.cloudflare.com, indicating the attacker leveraged a reputable CDN to hide origin infrastructure. No TLS certificate is presented, and the site currently returns an offline status, confirming that the malicious page has been taken down or is no longer serving content. The page title harvested from the site, “$ARI Airdrop is here!”, aligns with the listed phishing kit “Airdrop Scam” and the classification “Crypto Scam”.

This suggests the campaign attempted to lure victims with a false promise of an ARI token airdrop, a common social‑engineering vector in the crypto fraud ecosystem. VirusTotal has recorded 15 positive detections out of 95 scanned engines, reflecting a moderate level of consensus among security vendors that the domain is malicious. The domain is listed on a single public blocklist and has been explicitly blocked by the PhishDestroy service, providing additional confirmation of its abusive nature. Evidence gaps remain: the exact HTML content, form fields, and any payload delivery mechanisms have not been captured, and no Safe Browsing or Open Threat Exchange records are available for this host.

Consequently, the full scope of victim impact cannot be measured at this time. Defenders should add arichian.xyz to URL filtering and DNS block policies, monitor traffic to the associated Cloudflare IP address for any resurgence, and treat any email or messaging that references an “ARI airdrop” as suspicious. Continuous observation of the registrar NiceNIC International Group Co., Limited for future registrations may reveal repeat abuse.