app[.]arlaprotocol[.]io

Analysis indicates that the domain app.arlaprotocol.io was registered on November 7, 2025 through Eranet International Limited. The authoritative nameservers are isaac.ns.cloudflare.com and samara.ns.cloudflare.com, directing traffic to Cloudflare’s network. DNS resolution returns the IPv4 address 104.21.6.46, which belongs to AS13335, Cloudflare, Inc., and is geolocated in the United States. No TLS certificate was observed, meaning the site was served over plain HTTP. The only visible content during the scan was the page title “Your country blocked”, which does not disclose a targeted brand or specific lure.

Intelligence flags the domain as an account takeover (ATO) phishing operation. Reputation metrics are extremely poor: Gridinsoft assigned a trust score of 0 / 100, and the domain appears on a single security blocklist maintained by PhishDestroy. VirusTotal recorded one positive detection out of 95 scanned security vendors, confirming that at least one vendor flagged the host as malicious. The domain is currently marked offline and has been taken offline by the blocklist operator. The risk level is elevated, indicating that if the site were active it could be used to harvest credentials or facilitate account takeover attacks.

Defenders should block the domain at perimeter devices, monitor DNS queries for the domain and its associated IP, and add the host to internal blocklists. Because the infrastructure is hosted behind Cloudflare, any future re‑hosting could reuse the same edge IP range, so broader Cloudflare edge blocking should be considered only after impact analysis. Continuous re‑scanning is recommended to detect any re‑appearance, and analysts should examine the single VirusTotal positive for correlation with other campaigns. The lack of SSL and the generic page title provide limited forensic value, and further investigation of any underlying phishing kit would require access to archived content.