camelot-dex-arbitrum-native-decentralized-exchange[.]cc

Analysis of the domain camelot-dex-arbitrum-native-decentralized-exchange.cc indicates a high-risk brand impersonation threat targeting Arbitrum, a known decentralized finance platform. The domain, registered on February 21, 2026, through NiceNIC International Group Co., Limited, is currently active and employs Cloudflare nameservers (ezra.ns.cloudflare.com and margot.ns.cloudflare.com) alongside HTTP/3 technology. A 302 HTTP redirect status suggests dynamic routing, a common tactic in phishing or scam infrastructure to obscure final destinations or evade detection. The domain appears on one security blocklist and is flagged by 9 of 93 security vendors in a recent scan, reinforcing its malicious classification. It is explicitly listed in one AlienVault OTX threat intelligence pulse, further corroborating its association with fraudulent activity. The page title, www.www.camelot-dex-arbitrum-native-decentralized-exchange.cc, is anomalous and may indicate a misconfigured or hastily deployed scam site rather than a legitimate service. The scam type is classified as a crypto scam, aligning with the impersonation of Arbitrum’s ecosystem. Defenders should prioritize blocking this domain at the DNS or network level, particularly in environments where Arbitrum-related services are accessed. Monitoring for related infrastructure, such as IP addresses or additional domains using the same nameservers, is recommended to identify potential campaign expansion. Given the domain’s recent registration and active status, users should be alerted to avoid interaction, especially if solicited through unsolicited communications. The exact content and functionality of the site remain unanalyzed, but the observable infrastructure and threat intelligence strongly suggest malicious intent.