app[.]arbtirum[.]sbs

PhishDestroy identifies app.arbtirum.sbs as a live credential-harvesting domain designed to mimic a legitimate application portal in order to trick users into surrendering usernames and passwords. This site poses an immediate risk to anyone who receives a link or sees the domain in messages, search results, or pop-ups promising quick app access. Because it remains active and is not yet flagged by most security engines—currently showing 0 detections out of 95 engines on VirusTotal—it can evade filters long enough to harvest a meaningful number of victims before takedown efforts catch up. The domain’s low reputation combined with its recent appearance makes it especially dangerous for users who are not actively monitoring their browsing environment. This domain was flagged by PhishDestroy after deep DNS and behavioral analysis revealed a recently registered site with no legitimate ties to any known application ecosystem. It resolves to 104.21.61.40, a hosting address shared with numerous low-trust endpoints, and uses a Let’s Encrypt certificate to appear legitimate. Despite its clean SSL profile, the site exhibits classic phishing hallmarks: mismatched branding, inconsistent page layouts, and input fields that transmit data to external servers rather than the claimed application backend. At present, VirusTotal shows zero detections across its entire engine list, underscoring how new and unclassified this threat remains. If you visited app.arbtirum.sbs, immediately change any passwords you may have entered and enable multi-factor authentication on all accounts accessed from that device. Run a full antivirus scan to check for follow-on malware, inspect browser extensions for unauthorized access, and clear cached credentials. Report the domain to your security team or phishing abuse channels so it can be blocked at the network level. Avoid reopening the site, even to “check if it’s real,” as interaction can signal active interest to attackers and prolong the threat window.