arbsvvap[.]live

PhishDestroy identifies arbsvvap.live as an active crypto-drainer phishing domain designed to steal cryptocurrency assets from unsuspecting users. This malicious site masquerades as a legitimate crypto platform login portal, tricking victims into entering their wallet credentials or connecting their wallets to a fraudulent smart contract that drains funds directly. Once a user interacts with the fake interface, the drainer silently transfers tokens to attacker-controlled wallets, often exploiting vulnerabilities in wallet integrations to approve unauthorized transactions without explicit confirmation. This domain was flagged by 3 out of 95 security vendors on VirusTotal, indicating a high level of detection by reputable cybersecurity tools. It was registered on April 25, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known for hosting high volumes of suspicious domains. The site resolves to IP address 104.21.84.216 and uses a Let's Encrypt SSL certificate to appear legitimate. It has already been blocked by SEAL and MetaMask, two major security platforms, confirming its malicious nature. The domain’s recent creation date suggests it is part of a rapidly evolving campaign targeting crypto users during a period of high market activity. If you visited arbsvvap.live or entered any information, immediately revoke any wallet connections via your wallet’s interface, transfer remaining funds to a new wallet, and scan your device with reputable antivirus software. Do not interact with any prompts or links from this domain. Report the incident to your wallet provider and consider filing a complaint with your local cybercrime unit. Always verify URLs through PhishDestroy or similar threat intelligence platforms before clicking or entering sensitive data. Stay vigilant and prioritize security when managing digital assets.