arvestonlline[.]com

Analysis of the domain arvestonlline.com indicates it was actively impersonating Arvest Bank, a financial services brand, as evidenced by the page title 'Arvest Bank | Personal & Business Banking Solutions' and its classification as brand impersonation. The domain was registered on December 6, 2025, through MAT BAO CORPORATION and resolved to IP address 172.67.215.139, hosted on Cloudflare's network (AS13335) in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (arely.ns.cloudflare.com and ignacio.ns.cloudflare.com), a common tactic to obscure hosting origins and evade takedowns. No SSL certificate was detected, increasing the likelihood of interception or man-in-the-middle risks for visitors.

Detection data shows the domain was flagged by 14 of 95 security vendors on VirusTotal, though the specific detection rules or signatures are not detailed in the available evidence. It appears on at least one security blocklist and was proactively blocked by PhishDestroy. The domain's Gridinsoft trust score of 0/100 further corroborates its malicious classification. As of the report date, arvestonlline.com is offline, though its prior infrastructure and registration details remain relevant for historical analysis and threat correlation.

Defenders should treat this domain as confirmed malicious infrastructure, particularly for financial phishing campaigns targeting Arvest Bank customers. Monitoring for re-registration or DNS changes is recommended, as threat actors frequently reuse infrastructure components. Network-level blocking of the resolved IP (172.67.215.139) and associated Cloudflare nameservers may mitigate residual risk. No evidence links this domain to broader malware distribution or command-and-control activity, but its prior use for brand impersonation warrants continued scrutiny.