arc-blog-dyc[.]pages[.]dev

The domain arc-blog-dyc.pages.dev was registered on June 09, 2026 via Cloudflare Pages. It has been flagged by Google Safe Browsing for social engineering, and three independent blocklists have added it, indicating a consensus of malicious intent. The site is also listed by PhishDestroy, MetaMask, and SEAL, which are commonly used to block credential‑harvesting resources. VirusTotal reports that the domain was examined by 91 antivirus engines, none of which produced a detection at the time of analysis; while this absence does not imply safety, it illustrates that the payload may be crafted to evade static signatures.

Infrastructure observations show that the domain resolves to Cloudflare’s edge network, a typical pattern for abuse because it provides anonymity and rapid provisioning. No additional metadata such as SSL certificate details, HTTP response codes, or page titles are currently available in the intelligence feed, leaving the exact content of the landing page unverified. At present no evidence of SSL anomalies, HTTP redirects, or malicious code snippets has been captured, so the threat vector appears to rely primarily on social engineering rather than technical exploitation. The lack of visible branding or a specific scam category further limits attribution; however, the combination of blocklist presence and Safe Browsing classification strongly suggests a credential‑phishing campaign aimed at extracting user credentials, possibly targeting services that integrate with MetaMask.

Defenders should continue to block the domain at the network perimeter, update DNS filtering policies, and monitor for any related malicious traffic. Incident response teams encountering authentication attempts to the domain should treat them as compromised and initiate credential reset procedures. Ongoing surveillance is recommended to detect any evolution of the site, such as the introduction of malicious payloads or a shift in hosting infrastructure.