sbyb2jsnurhs25thcnx2maieniwhe4uvww5lksm6bmgynrbam7iq[.]arweave[.]net

Analysis indicates that the domain sbyb2jsnurhs25thcnx2maieniwhe4uvww5lksm6bmgynrbam7iq.arweave.net is actively serving generic phishing content as of July 18, 2026. The page title 'Loading…' suggests minimal or delayed rendering, which is consistent with obfuscation tactics used in credential-harvesting or malware-distribution schemes. Infrastructure analysis reveals the domain resolves to IP address 195.181.175.40 and uses a Let's Encrypt SSL certificate, providing a false sense of legitimacy. The domain was registered on January 25, 2018, through NameCheap, Inc., though the age of the registration does not correlate with current malicious activity. Two security vendors on VirusTotal have flagged this domain, and it appears on two independent security blocklists. It is also blocked by MetaMask and SEAL, indicating a likely focus on cryptocurrency-related fraud or wallet-draining attacks. While the exact phishing kit or targeted brand remains unconfirmed, the use of Arweave's decentralized storage suggests an attempt to evade traditional takedown mechanisms. Defenders should treat this domain as high-risk and prioritize blocking it at the network and endpoint levels. Further analysis of the hosted content is required to determine the specific attack vector or targeted assets.