arbiscan-info[.]webflow[.]io

This domain, arbiscan-info.webflow.io, is confirmed as a high-risk brand impersonation site targeting Arbitrum, a prominent layer-2 blockchain network. Analysis indicates the site mimics the legitimate block explorer interface, presenting a page title of 'Arbiscan - Arbitrum One Blocks Explorer' to deceive users into interacting with fraudulent content. No direct evidence of a crypto drainer kit was observed, but the site’s structure and branding align with tactics used to harvest credentials or facilitate unauthorized transactions. The domain leverages Webflow’s hosting infrastructure, a platform frequently exploited for rapid deployment of phishing campaigns due to its ease of use and low barrier to entry. Technical indicators reveal multiple red flags. The domain is flagged by 17 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100, indicating a complete lack of legitimacy. It is registered through Webflow, a registrar commonly associated with transient phishing domains, and resolves to the IP address 172.64.151.8, which is part of a content delivery network known for obfuscating malicious infrastructure. The domain appears on four security blocklists, including MetaMask and PhishDestroy, and employs an SSL certificate issued by Google Trust Services, a tactic often used to lend a false sense of security. No creation date was provided, but the domain’s recent appearance on blocklists suggests it was operational for a short period before detection. As of the latest assessment, arbiscan-info.webflow.io has been taken offline, likely due to enforcement actions by the hosting provider or security entities. However, the infrastructure remains a residual risk, as similar domains may resurface under different subdomains or registrars. Users are advised to verify the authenticity of block explorer URLs by cross-referencing with official Arbitrum communications and to employ browser-based security extensions that block known phishing domains. Organizations should monitor for domains leveraging Webflow or Cloudflare infrastructure, particularly those impersonating blockchain services, and update blocklists accordingly to mitigate potential exposure.