a4nvmg5g5ykbcvr4wjoj752e3spcrp2js6vr7ogzuwsnmt75ghjq[.]arweave[.]net

The domain a4nvmg5g5ykbcvr4wjoj752e3spcrp2js6vr7ogzuwsnmt75ghjq.arweave.net is currently flagged as a generic phishing threat and remains under investigation as of the report date, August 05, 2026. Registration data shows the domain was created on January 25, 2018 and was registered through Namecheap Inc. Its authoritative name servers are aurora.ns.cloudflare.com and nitin.ns.cloudflare.com, indicating use of Cloudflare’s DNS infrastructure. DNS resolution points to the IP address 195.181.170.19, which is the sole host observed for this domain.

The domain appears on one public security blocklist and is explicitly blocked by the PhishDestroy service, confirming that at least one defensive platform has identified it as malicious. VirusTotal records indicate the domain was scanned by 91 antivirus and URL‑reputation engines, with none of those engines generating a detection. While the lack of detections may suggest the payload is not yet recognized by the scanned vendors, it does not constitute evidence of safety and should be interpreted as a gap in current detection coverage.

No additional intelligence such as SSL certificates, HTTP response codes, page titles, or external reputation scores is presently available, leaving the content and exact phishing campaign details unknown. Consequently, defenders should continue to block the domain at network perimeter devices, update DNS filtering rules to include the observed IP address, and monitor for any new indicators that may emerge from future scans or blocklist additions. Ongoing observation is recommended to capture any changes in hosting, resolver configuration, or detection status that could affect the risk posture of this infrastructure.