nexarbitinc[.]com

Analysis indicates that the domain nexarbitinc.com is actively used for a high‑risk brand‑impersonation campaign targeting the MetaMask brand. The domain resolves to the IP address 104.21.27.95, which is hosted within the Cloudflare network (AS13335) and geolocated to the United States. Registration details show the domain was created on December 5, 2025 and was registered through Gname.com Pte. Ltd. The authoritative name servers are matteo.ns.cloudflare.com and priscilla.ns.cloudflare.com, confirming Cloudflare DNS usage. The site presents an HTTP 301 redirect and serves a TLS certificate issued by Google Trust Services under the WE1 identifier, indicating a valid SSL chain. Security scanning on VirusTotal reports that 3 of 91 vendors have flagged the domain, and the domain appears on three external blocklists. It is presently blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a brand‑impersonation threat. Gridinsoft assigns a trust score of 0 out of 100, and AlienVault OTX references the domain in one threat‑intel pulse. The page title returned from the HTTP response is "NEXARBITINC," but no additional page content has been publicly verified, leaving the exact phishing payload or credential‑harvesting mechanisms uncertain. Defenders should block the domain at DNS and proxy layers, monitor outbound connections to the associated IP, and include the domain in threat‑intel feeds. Continuous re‑scanning with sandbox and URL analysis tools is recommended to detect any evolving malicious content or credential‑capture pages that may be deployed behind the redirect.