arc-usernames[.]pages[.]dev

This domain, arc-usernames.pages.dev, operates as a fraudulent crypto identity claim portal targeting users of the Arc browser ecosystem. Analysis of the page content reveals a phishing scheme designed to harvest credentials under the pretense of "claiming an Arc identity," a tactic commonly associated with wallet drainer operations. The site employs social engineering to trick visitors into entering sensitive information, likely redirecting inputs to attacker-controlled infrastructure for immediate exploitation or future credential-stuffing attacks. Infrastructure analysis provides multiple indicators of malicious intent. The domain was registered through Cloudflare, Inc. on May 23, 2026, with an anomalous future creation date suggesting potential WHOIS manipulation. It currently resolves to IP address 172.66.44.202, hosted in Canada under Cloudflare's network. While VirusTotal shows 0 detections out of 95 engines, the domain appears on 3 independent security blocklists, including high-confidence feeds from cryptocurrency security platforms. The site uses a Let's Encrypt E8 SSL certificate, providing HTTPS encryption to lend false legitimacy to the phishing attempt. Users who visited arc-usernames.pages.dev should immediately revoke any active sessions associated with the site and assume all entered credentials are compromised. Reset passwords for any accounts where identical credentials were used, particularly cryptocurrency wallets or browser sync services. Monitor connected devices for unauthorized access attempts and review transaction histories for unexpected activity. Security teams should add this domain to blocklists with the following indicators: domain arc-usernames.pages.dev, IP 172.66.44.202, and SSL certificate thumbprint corresponding to Let's Encrypt E8. The anomalous 2026 creation date may indicate broader infrastructure compromise requiring additional investigation.