arcdomains-fkjbxqbmtg[.]edgeone[.]app

This domain, arcdomains-fkjbxqbmtg.edgeone.app, is identified as a phishing infrastructure targeting cryptocurrency users under the guise of a USDC registrar service. The page title, 'Arc Domains | Premium USDC Registrar,' suggests an attempt to impersonate a legitimate domain registration or cryptocurrency service, likely aiming to harvest credentials or facilitate fraudulent transactions. No specific drainer kit signatures were detected in initial scans, but the use of generic phishing tactics aligns with known cryptocurrency-themed attacks. The domain exhibits characteristics consistent with credential harvesting or wallet-draining schemes, particularly those targeting users of decentralized finance (DeFi) platforms. Analysis indicates the domain resolves to the IP address 43.152.26.58 and is registered through Tencent EdgeOne, a content delivery network (CDN) service. The SSL certificate is issued by DigiCert, Inc., a common but not inherently malicious certificate authority. VirusTotal reports 2 out of 95 security vendors flagging this domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on three security blocklists and is currently categorized with an elevated risk level. No Google Safe Browsing (GSB) listing was detected at the time of analysis, though this may reflect a lag in propagation rather than a clean status. The detected technologies include Tailwind CSS, Cloudflare, and cdnjs, which are frequently used in both legitimate and malicious web applications. As of the latest assessment, the domain has been taken offline, likely in response to security vendor detections and blocklist inclusions. Prior to its removal, the domain was blocked by multiple security platforms, including MetaMask and PhishDestroy, indicating proactive mitigation efforts. Despite its current offline status, residual risk remains due to the potential for infrastructure reuse or rebranding under a new domain. Users who may have interacted with this domain are advised to audit their cryptocurrency wallets for unauthorized transactions and reset any credentials entered on the site. Organizations should monitor for similar domains leveraging EdgeOne or Tencent Cloud infrastructure, particularly those impersonating cryptocurrency services.