defi-on-arc[.]vercel[.]app

defi‑on‑arc.vercel.app is an active crypto‑drainer infrastructure first observed on 21 May 2026. The domain was registered through Vercel Inc. and resolves to the IP address 216.198.79.195, which is geolocated to the United States and associated with Vercel’s hosting network. The site presents the page title “DeFi on ARC – Bridge, Swap, and Manage Liquidity”, suggesting it attempts to lure users interested in decentralized finance services. The TLS certificate is issued by Google Trust Services under the WR1 certificate authority, indicating a valid HTTPS endpoint. HTTP responses return a 308 permanent redirect, and the server advertises Cloudflare Browser Insights, Cloudflare, and HTTP/3, confirming the use of Cloudflare’s edge platform. The domain has been added to three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, reflecting consensus among multiple mitigation tools that the site functions as a crypto drainer. The Gridinsoft trust score of 0 / 100 further reinforces its malicious reputation. No nameserver information is publicly available. Although VirusTotal has not flagged the domain, the absence of detections does not imply safety. Analysts should treat any interaction with the site as hostile, block the domain at network perimeter, monitor DNS queries for the domain, and consider adding it to internal blocklists. Ongoing observation is recommended to detect any changes in hosting, certificate, or redirection behavior.