arcwthbnkfin[.]com[.]forefrecov[.]com

The domain arcwthbnkfin.com.forefrecov.com is a confirmed phishing site engaged in brand impersonation, specifically targeting Google under the guise of a tech-support scam. It presents itself as 'ArcWealth Banking and Finance' but does not host a crypto drainer kit. The site is currently taken offline, reducing immediate risk, though its prior activity poses a threat of credential theft or fraudulent tech-support schemes.

Technical indicators show limited detection, with 1 of 95 VirusTotal security vendors flagging arcwthbnkfin.com.forefrecov.com. The domain was created on 2026-02-21 07:01:08 and resolves to the IP address 198.12.93.82, hosted on AS36352 (HostPapa) in the US. It appears on 1 security blocklist (PhishDestroy) and uses an SSL certificate issued by R10. Google Safe Browsing has not flagged the domain, and the Gridinsoft trust score is 0/100.

Victims of arcwthbnkfin.com.forefrecov.com should change any passwords entered on the site, enable two-factor authentication on affected accounts, and monitor for unauthorized transactions or account activity. Report the domain to Google Safe Browsing, PhishTank, or local cybercrime authorities to aid in takedown efforts. If financial or personal data was exposed, consider contacting relevant institutions to secure accounts.