alrcsn[.]vip

Analysis of alrcsn.vip, observed on July 22, 2026, indicates that the domain was actively used for a generic phishing campaign before being taken offline. The site presented the page title "Alrcsn" and was built on Vue.js, employing HSTS, HTTP/3, Cloudflare Browser Insights, and Cloudflare services. DNS resolution points to the Cloudflare‑owned address 172.67.213.173, with authoritative nameservers eleanor.ns.cloudflare.com and lamar.ns.cloudflare.com, confirming that the infrastructure was hosted behind Cloudflare’s network.

The domain was registered on March 22, 2026 through Gname.com Pte. Ltd., and the TLS certificate was issued by Let’s Encrypt (certificate profile E8), indicating a standard automated certificate issuance process. Security telemetry shows that alrcsn.vip appears on three independent blocklists and has been blocked by PhishDestroy, MetaMask, and SEAL, demonstrating that multiple anti‑phishing and cryptocurrency wallet protection services have flagged the site. VirusTotal scans report three positive detections out of ninety‑four vendors, providing additional corroboration of malicious intent.

While the site is currently offline, defenders should retain the indicator set—including the domain name, resolving IP address, registrar, and certificate details—in threat‑intel feeds and blocklists. Continuous monitoring of the registrar Gname.com Pte. Ltd. for any re‑registration attempts, as well as periodic re‑resolution of the domain, is advised to detect potential re‑use of the same infrastructure. Given the combination of known phishing classification, blocklist presence, and vendor detections, the domain should be treated as malicious and proactively denied in network and endpoint security controls.