quests-arcium[.]app

Analysis identifies quests-arcium.app as a crypto drainer infrastructure impersonating the Arcium brand to target cryptocurrency users. The domain is associated with malicious wallet-draining behavior and is currently marked as offline following security enforcement actions and blocklisting activity.

Technical telemetry indicates the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to IP 188.114.97.3. It was created on June 22, 2026. It is flagged by 4 of 95 VirusTotal vendors and appears on 3 security blocklists, including MetaMask, PhishDestroy, and SEAL. The presence of Google Trust Services SSL suggests abuse of legitimate certificate authorities to increase perceived trust while masking malicious intent. The infrastructure profile indicates rapid deployment of a newly registered domain combined with early-stage detection by multiple security engines.

Current risk posture suggests an active crypto drainer campaign leveraging freshly registered infrastructure with partial detection coverage across vendor ecosystems. Although the domain is currently taken offline, historical indicators imply potential for rapid redeployment using similar naming patterns or mirrored hosting. It is recommended to enforce DNS-level blocking, maintain updated threat intelligence feeds for related domains, and monitor wallet interaction attempts originating from related IP space. Security teams should treat any residual traffic, cached redirects, or similarly structured domains as high-risk and apply proactive user warnings to prevent credential or asset compromise.