kjdfjhhjdsgf1[.]enter-arcus[.]xyz

This domain, kjdfjhhjdsgf1.enter-arcus.xyz, was registered on 2026-07-28 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently resolved to the IP address 172.67.155.200. The domain uses Cloudflare DNS infrastructure, as indicated by the authoritative nameservers jimmy.ns.cloudflare.com and tia.ns.cloudflare.com. Reputation checks show that the domain appears on a single security blocklist and is actively blocked by the PhishDestroy feed. A VirusTotal scan performed on the domain has been submitted to 91 AV engines, none of which returned a detection; the lack of detections does not constitute a safety assurance.

The domain is classified as a generic phishing site, with its status listed as active and under investigation. At the time of reporting the site is still reachable, though no page title or content analysis has been published, leaving the exact phishing lure unknown. The short age of the domain—approximately one week from creation to the report date—combined with the use of a reputable CDN provider is a pattern observed in many opportunistic phishing campaigns. Defenders should prioritize adding the domain to local blocklists and ensure that network egress filtering rejects outbound connections to the IP 172.67.155.200.

Continuous monitoring of the associated IP and Cloudflare nameserver resolutions is advised, as attackers may repurpose the same infrastructure for additional malicious domains. Integration of the domain into threat‑intelligence platforms, including the PhishDestroy feed, will provide automated alerts for any future sightings. Given the absence of detailed payload or landing‑page evidence, further investigation—such as sandbox retrieval of the site’s content—should be conducted to confirm the phishing vector and to uncover any credential‑harvesting forms that may be present.