arbihunter[.]pro

This domain, arbihunter.pro, is identified as a phishing site targeting cryptocurrency users under the guise of offering arbitrage strategies. Analysis indicates the domain impersonates legitimate crypto arbitrage platforms, likely aiming to harvest credentials, private keys, or deposit funds into fraudulent wallets. The page title, 'ArbiHunter — Best Crypto Arbitrage Strategy,' suggests a focus on tricking users into believing they are accessing a high-yield investment opportunity, a common tactic in crypto-related phishing schemes. Infrastructure analysis reveals the domain was registered on May 26, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with malicious domains. It resolves to the IP address 172.67.220.79 and employs Cloudflare, a content delivery network often used to mask hosting origins and evade detection. Despite its recent creation, the domain has already been flagged on 2 security blocklists. VirusTotal reports 0/95 detections, indicating it has not yet been widely recognized by antivirus engines, though this does not diminish its confirmed malicious status. The use of HTTP/3 further suggests an attempt to leverage modern protocols to bypass legacy security controls. Users who visited arbihunter.pro should immediately revoke any permissions granted to the site in browser-based crypto wallets or extensions. Any credentials, seed phrases, or private keys entered on this domain must be considered compromised and should be migrated to new, secure wallets. Monitor linked accounts for unauthorized transactions and enable multi-factor authentication where available. Network administrators should block the domain and its resolving IP (172.67.220.79) at the firewall or DNS level to prevent further exposure. Given the domain's current offline status, it may reappear under a different name or IP; vigilance is advised for similar phishing attempts targeting crypto arbitrage themes.