arichains[.]xyz

This domain arichains.xyz is currently listed as offline but remains flagged by multiple security controls. The site resolved to the IPv4 address 188.114.96.3, which belongs to AS13335 operated by Cloudflare, Inc. in the United States. Registration data show the domain was created on November 06, 2025 through NiceNIC International Group Co., Limited, and it uses the Cloudflare nameservers amit.ns.cloudflare.com and michelle.ns.cloudflare.com. No TLS certificate was observed, indicating the site served only plain HTTP.

The page title retrieved from the site – “$ARI Airdrop is here!” – together with the classification “Crypto Scam” and the identified “Airdrop Scam” kit points to a fraudulent cryptocurrency airdrop campaign designed to lure victims into submitting private keys or wallet credentials. VirusTotal analysis recorded 12 detections out of 95 scanning engines, and the domain is presently blocked by PhishDestroy and ScamSniffer, appearing on 2 security blocklists. Scamadviser assigned a trust score of 41 out of 100, reflecting a low reputation. The combination of Cloudflare hosting, a recent registration date, absence of SSL, and a modest detection count suggests a short‑lived phishing operation that has already been taken down.

However, the underlying infrastructure – the same IP and nameserver pair – may be reused for future campaigns. Defenders should continue to denylist arichains.xyz at DNS and proxy layers, monitor the host IP 188.114.96.3 for new hostnames, and apply URL filtering rules that catch the “$ARI” keyword pattern. Email security gateways should be tuned to flag messages referencing airdrop promises involving the “$ARI” token. Because the site is offline, immediate network traffic is minimal, but the observed indicators warrant inclusion in threat‑intel feeds and ongoing watch for re‑appearance or related domains.