arbquest[.]live

This domain, arbquest.live, is confirmed as a brand impersonation scheme targeting users of the Arbitrum cryptocurrency platform. The site presents itself as an official Arbitrum Quest portal, advertising an ARB token airdrop and ARB/USDC swap functionality. Such impersonation typically aims to deceive users into connecting their cryptocurrency wallets to malicious smart contracts, leading to unauthorized token transfers or complete wallet drainage. The page title, 'Arbitrum Quest: Join the ARB Token Airdrop & Swap ARB/USDC,' directly mimics legitimate Arbitrum promotional campaigns, increasing the likelihood of successful social engineering attacks against unsuspecting users seeking airdrop opportunities.

Analysis of arbquest.live reveals multiple high-confidence indicators of malicious activity. The domain was registered on July 14, 2025, through GoDaddy.com, LLC, a registrar frequently abused for short-lived phishing domains. VirusTotal detection shows 8 out of 95 security vendors flagging the domain as malicious, while it appears on 2 distinct security blocklists. Infrastructure analysis indicates the domain resolves to IP address 104.21.44.7, protected by Cloudflare, and utilizes technologies including Tailwind CSS and HTTP/3. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its free and automated issuance process. Gridinsoft assigns a trust score of 0/100, further corroborating the domain's fraudulent nature.

Users who visited arbquest.live should immediately cease all interaction with the site. If wallet credentials or seed phrases were entered, assume full compromise and take the following steps: transfer all assets to a new, secure wallet; revoke any suspicious smart contract approvals using a blockchain explorer; and monitor all connected accounts for unauthorized transactions. Report the incident to the legitimate Arbitrum security team for further investigation. Given the domain's current offline status, users should remain vigilant for similar impersonation attempts, particularly those leveraging current or upcoming airdrop announcements as a lure.