m[.]paokllnbi[.]com

Analysis of m.paokllnbi.com shows a newly registered domain created on March 11, 2026 that is currently taken offline but exhibits multiple indicators of malicious activity. The domain resolves to the IP address 43.203.132.165, which is hosted in South Korea and belongs to AS16509 owned by Amazon.com, Inc. The hosting provider is therefore a large cloud service, a common choice for transient malicious infrastructure. Registration was performed through Gname.com Pte. Ltd., and the authoritative nameservers are a1.share-dns.com and b1.share-dns.net, both of which are frequently observed in fast‑flux or disposable domain setups. The site presented an SSL certificate issued by Let’s Encrypt (R13), indicating that HTTPS was enabled at some point, a tactic often used to increase user trust.

The page title returned "PANTERA," which does not correspond to the claimed brand target, Arbitrum, suggesting the content may have been altered or is otherwise unrelated to the brand being impersonated. The domain is classified as a crypto scam and specifically impersonates the Arbitrum brand, a known target for fraudulent schemes seeking cryptocurrency credentials. It appears on three security blocklists and has been flagged by three independent blocking services—PhishDestroy, MetaMask, and SEAL—demonstrating consensus among threat intelligence sources. VirusTotal recorded a single detection out of 94 security vendors, reinforcing the suspicion despite the low count.

Gridinsoft assigned a trust score of 0 out of 100, indicating a complete lack of confidence in the domain’s legitimacy. While the site is presently offline, the combination of recent creation, cloud‑based IP, low‑reputation nameservers, brand impersonation, and multiple blocklist entries warrants elevated risk. Defenders should continue to block the domain at network perimeter, monitor for any re‑activation, and add the IP address 43.203.132.165 to threat intelligence feeds.