arbihub[.]world

The domain arbihub.world was observed on 23 July 2026 as an active wallet/seed phishing site. Registration records show the domain was created on 22 January 2026 through Hostinger operations UAB, and the authoritative nameservers are ns1.dns-parking.com and ns2.dns-parking.com. DNS resolution points to the IPv4 address 84.32.84.124, which belongs to AS47583 Hostinger International Limited and is geolocated in Lithuania. The web server presents a TLS certificate issued by Let’s Encrypt (R13) and returns HTTP 403 for the root request, while the page title reported by the scanner reads "Arbihub – Home".

Mail exchange records are configured to mx1.hostinger.com (priority 5) and mx2.hostinger.com (priority 10). Reputation services assign a Gridinsoft trust score of 0 out of 100, and the domain appears on three external blocklists. VirusTotal analysis recorded 16 positive detections out of 95 scanning engines, and Google Safe Browsing classifies the site as a social‑engineering threat. Additional protective products, including PhishDestroy, MetaMask, and SEAL, have listed the domain as blocked.

The available evidence confirms the infrastructure is deliberately hosted on a legitimate cloud provider to lend credibility, while the HTTP 403 response suggests the malicious payload may be delivered only after specific interaction. No further content analysis is available beyond the page title, leaving the exact phishing flow uncertain. Defenders should immediately block traffic to 84.32.84.124 and to the domain arbihub.world, monitor for related subdomains, and incorporate the domain into email filtering rules. Continuous re‑evaluation is advised in case the site changes its response code or hosts additional resources.