03arvest-online[.]fun

This domain, 03arvest-online.fun, was registered through Unstoppable Domains Inc. on August 11, 2025. The site resolves to the Amazon Web Services address 18.117.177.65, which belongs to ASN 16509 (Amazon.com, Inc.) and is geolocated in the United States. No TLS certificate is presented, meaning all traffic is unencrypted. The HTTP response returns the generic directory listing title “Index of /”, and the site is currently marked as offline.

VirusTotal has recorded 16 detections out of 93 scanned security vendors, indicating a moderate level of consensus among analysis engines that the domain is malicious. AlienVault OTX references the domain in two separate threat‑intelligence pulses, and it appears on one public blocklist that is enforced by the PhishDestroy service. Google Safe Browsing classifies the URL as a social‑engineering threat, which aligns with the generic phishing attribution. The available data confirm that the infrastructure is hosted on a reputable cloud provider, yet the absence of TLS, the directory‑listing page title, and multiple independent detections suggest deliberate use for credential‑stealing or other social‑engineering campaigns.

The lack of further public artefacts—such as sample phishing pages, specific lure content, or victim reports—leaves the exact payload and target audience uncertain. Defenders should add 03arvest-online.fun to web‑filtering and DNS‑sinkhole rules, block outbound connections to 18.117.177.65, and monitor for any login attempts or credential submissions directed at this host. Because the domain is already listed by PhishDestroy, existing blocklist feeds can be leveraged, but independent verification through the observed detections is advisable. Continuous re‑evaluation is recommended in case the domain is re‑activated or repurposed.