arcblink[.]xyz

This domain, arcblink.xyz, is an active crypto drainer site designed to extract cryptocurrency wallet credentials through brand impersonation of ArcPay. The site remains operational as of the latest verification, presenting a high-risk threat to users interacting with its interface. Analysis indicates the domain is flagged by 4 of 95 security vendors on VirusTotal, with additional detections on three independent blocklists. Infrastructure analysis reveals registration through Porkbun LLC, resolution to IP address 69.46.46.23, and an SSL certificate issued by Let’s Encrypt (YE1). The page title explicitly displays "ArcPay," reinforcing the impersonation vector. No historical data suggests prior legitimate use, and the domain’s creation date aligns with recent phishing campaign patterns. Current status confirms the domain remains active, with no takedown or mitigation measures observed. Organizations and individuals are advised to implement immediate network-level blocking of 69.46.46.23 and arcblink.xyz. Users should verify wallet interactions via official ArcPay channels only, and security teams should monitor for credential theft attempts originating from this infrastructure. Proactive hunting for related domains registered under Porkbun LLC or resolving to the same IP range is recommended.