arabclub-claim[.]vercel[.]app

Analysis indicates that the domain arabclub-claim.vercel.app was registered on 21 February 2026 through Tucows Domains Inc. The site was hosted on Amazon’s AS16509 infrastructure, resolving to IP 216.198.79.67 located in the United States. The TLS certificate is issued by Google Trust Services under the WR1 designation, and the server advertised HTTP Strict Transport Security. The web server responded with HTTP 451, indicating that the content is unavailable for legal reasons, and the current operational status is reported as offline. Open‑source intelligence classifies the site as a crypto‑drainer scam; the page title returned by the server is “ARABCLUB Hunt”.

The domain appears on five independent blocklists – PhishDestroy, ScamSniffer, Polkadot, Enkrypt and Codeesura – reinforcing the assessment of malicious intent. VirusTotal scans show that two of ninety‑five security vendors flagged the domain, providing additional corroboration of suspicious behavior. The available data does not include any observed payload, wallet addresses, or victim interaction details, so the specific mechanism of the crypto‑draining operation remains unknown. Likewise, no malware samples or command‑and‑control infrastructure have been disclosed.

Defenders should therefore treat the domain as high‑confidence malicious, enforce network‑level deny rules for the domain and its resolving IP, and add the listed blocklist entries to existing filtering solutions. Continuous monitoring of the IP range associated with AS16509 is advised, as the same infrastructure may host other illicit assets. Because the site is already offline, incident response teams should verify whether any recent outbound connections from internal assets targeted the domain before takedown, and, if found, initiate appropriate containment and forensic collection.