jsijhyg7kgbsenvkm2tqfaptgr673meydoty3vbbrvkvwvi7afma[.]arweave[.]net

The domain jsijhyg7kgbsenvkm2tqfaptgr673meydoty3vbbrvkvwvi7afma.arweave.net is flagged as an elevated‑risk generic phishing site. Infrastructure analysis shows the domain resolves to IP 195.181.170.19, a server hosted by CDN77 in Frankfurt, Germany, and is registered through Namecheap Inc. The TLS certificate is issued by Let’s Encrypt, and an HTTP 451 response was returned, indicating the content was blocked for legal reasons. The page title returned by the server is "Loadingâ…" which provides no additional context about the payload.

The site has been listed on three security blocklists and is actively blocked by the PhishDestroy, MetaMask, and SEAL filtering solutions. VirusTotal scans reported two detections out of ninety‑one security vendors, confirming that at least a small subset of scanners identified malicious behavior. The scam type is recorded as Brand Impersonation, suggesting the domain was used to imitate a legitimate brand to lure victims, though the specific brand is not disclosed in the available data.

Because the domain is currently taken offline, active exploitation cannot be confirmed, but the combination of blocklist presence, detection by multiple vendors, and the HTTP 451 status indicates a high likelihood of phishing intent. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑hosting attempts, and ensure that endpoint protection solutions are updated to include the two VirusTotal detections. Continuous observation of the IP address space owned by CDN77 for similar patterns is recommended, as is periodic re‑scanning of the domain should it become reachable again.