arthurbfxsignals[.]org

The domain www.arthurbfxsignals.org is currently listed as active and has been identified as a generic phishing infrastructure targeting credential collection. According to the latest intelligence, the domain was registered on August 20, 2025 through TuringSign Inc. d/b/a Cosmotown and is served by the authoritative name servers ns10.my-control-panel.com and ns9.my-control-panel.com. DNS resolution points to the IPv4 address 198.251.89.168, which is the sole hosting endpoint observed for this campaign. The domain is presently blocked by the PhishDestroy mitigation service and appears on a single external security blocklist, indicating limited but confirmed detection in the wild.

VirusTotal analysis shows that one out of ninety‑one scanning engines has flagged the domain, suggesting at least one vendor has identified malicious characteristics. No additional public indicators such as SSL certificate details, HTTP response codes, Safe Browsing verdicts, or page title information are presently available, leaving the surface‑level behavior of the web server uncharacterized. Defenders should prioritize the immediate addition of www.arthurbfxsignals.org to perimeter blocklists and ensure that any outbound traffic to the associated IP address 198.251.89.168 is denied.

Network intrusion detection signatures should be updated to flag DNS queries for the domain and its name servers. Continuous monitoring of the hosting IP for any new sub‑domains or related activity is recommended, as the limited blocklist presence may allow the infrastructure to expand before broader detection. Organizations should also consider sharing observed indicators with threat‑intel platforms to improve collective visibility of this nascent phishing campaign.