arlchain[.]xyz

Analysis of arlchain.xyz, registered on November 07, 2025 through NiceNIC International Group Co., Limited, indicates a confirmed crypto‑related phishing operation. The site presents the page title "$ARI Airdrop is here!" and is associated with the known Airdrop Scam phishing kit. Infrastructure inspection shows the domain resolving to 172.67.207.229, an IP owned by AS13335 Cloudflare, Inc. in the United States, and using Cloudflare nameservers amit.ns.cloudflare.com and michelle.ns.cloudflare.com.

The service employs Cloudflare’s HTTP/3 protocol and presents an SSL certificate issued by Google Trust Services under the "WE1" designation, confirming the use of legitimate TLS infrastructure to increase credibility. Risk scoring from Scamadviser assigns a trust score of 31 out of 100, and the domain appears on two external security blocklists. Detection engines on VirusTotal have flagged the domain in 12 of 95 scanned vendors, and commercial blocklist providers PhishDestroy and ScamSniffer have already listed it as malicious.

The current operational status is offline, but historical activity suggests it was actively delivering a crypto airdrop lure prior to takedown. Defenders should continue to block the domain and associated IP address at perimeter and DNS filtering layers, monitor for any re‑hosting attempts leveraging the same Cloudflare configuration, and correlate any internal traffic to the listed nameservers or IP with the 12 vendor detections. Given the elevated risk classification, security teams should also audit user reports for similar airdrop phishing attempts, update threat intel feeds with the domain’s indicators, and consider sharing the findings with industry sharing platforms to reinforce collective defenses against this specific Airdrop Scam pattern.