arc-defi[.]pages[.]dev

This domain, arc-defi.pages.dev, operates as an active crypto drainer phishing endpoint designed to illicitly siphon cryptocurrency assets from victims. The site presents itself under the guise of 'Arc DeFi,' a fabricated decentralized finance platform, to deceive users into connecting wallets or entering private keys. Once interaction occurs, malicious scripts automatically execute unauthorized transactions, transferring funds to attacker-controlled addresses without user consent. The threat specifically targets wallet integration protocols, exploiting trust in DeFi interfaces to facilitate financial theft. Analysis indicates the domain is hosted on infrastructure associated with 188.114.97.3 and was registered through Cloudflare Pages on June 10, 2026. Detection metrics reveal 7 out of 95 security vendors on VirusTotal have flagged the domain as malicious, while it appears on three independent security blocklists. Additional technical indicators include an SSL certificate issued by Google Trust Services (WE1) and active blocking by multiple threat intelligence feeds. The domain remains operational despite these detections, suggesting persistent malicious intent. Users who have visited arc-defi.pages.dev or interacted with its content should immediately revoke any connected wallet permissions and transfer remaining assets to a new, secure wallet. All devices used to access the site should undergo a full security scan to detect potential malware or unauthorized scripts. Cryptocurrency transactions initiated during the interaction period must be reviewed for anomalies, and affected parties are advised to report the incident to relevant blockchain analytics platforms for further investigation. No further engagement with the domain or its associated infrastructure should occur under any circumstances.