ranchimallarbitrumwallet[.]pages[.]dev

Retained for the record. This text repeats stored detection facts and is not presented as authored analysis.

This domain, ranchimallarbitrumwallet.pages.dev, is confirmed to be a brand impersonation attack targeting the Arbitrum brand. The site impersonates official Arbitrum web resources, potentially leading users to disclose sensitive information such as login credentials and private keys, which can result in financial loss and identity theft.

Analysis indicates that the domain resolves to the IP address 172.66.44.58, which is located in the United States and is part of the AS13335 Cloudflare, Inc. network. The domain was created on January 30, 2026, and is registered through Cloudflare, Inc. It appears on 3 security blocklists, confirming its malicious nature. On VirusTotal, 3 out of 95 security vendors have flagged this domain as malicious. The site is titled 'FLO Arbitrum,' further emphasizing its intent to deceive users into believing it is an official Arbitrum resource. The SSL certificate is issued by Google Trust Services / WE1, which may give a false sense of security.

If users have visited this domain, they are advised to immediately change their passwords and any other credentials they may have entered. They should also monitor their financial accounts and check for any unauthorized transactions. Additionally, users should verify the security of their devices, run a full system scan, and consider enabling two-factor authentication on all accounts related to Arbitrum and other cryptocurrency services. Reporting the incident to the official Arbitrum support and any relevant financial institutions is also recommended.