arc-presale[.]pages[.]dev

Analysis of the domain arc-presale.pages.dev indicates active phishing infrastructure targeting cryptocurrency users, specifically those interested in presale opportunities. Registered on June 8, 2026, through Cloudflare Pages, this domain exhibits characteristics consistent with high-risk social engineering campaigns. As of July 29, 2026, the domain is flagged by 10 of 91 security vendors on VirusTotal, suggesting moderate but growing detection coverage. It appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, which specialize in identifying fraudulent crypto-related domains.

Google Safe Browsing further classifies the domain as engaging in social engineering, reinforcing its malicious intent. Infrastructure analysis reveals the domain is hosted on Cloudflare's content delivery network, a common tactic among threat actors to obscure origin servers and leverage Cloudflare's SSL encryption. The exact content of the site remains unconfirmed, as no specific brand impersonation or phishing kit details are currently available in public threat feeds. However, the combination of the domain name, detection by crypto-focused blocklists, and social engineering classification strongly suggests it is designed to deceive users into disclosing wallet credentials or transferring funds under false pretenses.

Defenders are advised to treat this domain as high-risk and implement blocking measures at the network and endpoint levels. Organizations operating in the cryptocurrency space should prioritize user education to mitigate the risk of financial loss. Continuous monitoring of detection rates and blocklist additions is recommended, as further analysis may reveal additional indicators of compromise or campaign linkages. No IP addresses or autonomous system details are currently associated with this domain in public threat intelligence, limiting attribution efforts at this stage.