arcproof-files[.]pages[.]dev

Analysis of arcproof-files.pages.dev as of July 19 2026 indicates that the site is actively hosting a generic phishing campaign. The page title returned by the server is “ArcProof — Digital Service Escrow,” suggesting an attempt to impersonate a service escrow provider. HTTP response code 200 and a valid TLS certificate issued by Google Trust Services under the WE1 name confirm that the site is reachable and presents a seemingly legitimate HTTPS connection. The domain is hosted on Cloudflare Pages, resolves to IP 172.66.47.82, and the IP is geolocated to Cloudflare, Inc. in Canada. Reputation services have flagged the domain: PhishDestroy, MetaMask, and SEAL have added it to their blocklists, and Google Safe Browsing classifies it as social engineering. VirusTotal reports that 12 of 91 scanned security vendors flag the domain, indicating a moderate level of detection across the industry. The risk level is marked high, and the domain remains active. No additional infrastructure details, such as associated command‑and‑control servers or malware payloads, have been disclosed. Defenders should continue to block the domain at network perimeter and endpoint layers, monitor DNS queries for the resolved IP address, and consider adding the domain to internal blocklists. Users should be warned that any unsolicited request referencing ArcProof or a digital escrow service originating from this host is likely malicious, and credentials should never be entered.