arc-x[.]xyz

This domain, arc-x.xyz, was registered through Go Daddy, LLC on 11 March 2026. The authoritative name servers ns07.domaincontrol.com and ns08.domaincontrol.com resolve the zone to the single address 216.198.79.1, an Amazon Web Services host (AS16509) located in the United States. The site presented an HTTPS endpoint secured by a Let’s Encrypt certificate (R12) and advertised HSTS, indicating that the operator configured TLS and strict transport security. The underlying platform was identified as Vercel, a common hosting service for short‑lived malicious pages.

Public reputation services have flagged the domain. VirusTotal recorded a single positive detection out of 95 scanned security vendors, and Google Safe Browsing classified the page as a social‑engineering threat. The domain appears on three external blocklists and is actively listed by PhishDestroy, MetaMask, and SEAL. The page title returned by the HTTP response is “ArcX”, but no further content analysis is available because the site was taken offline prior to this assessment.

The combination of recent registration, use of a reputable CDN, a valid TLS certificate, and a single vendor detection suggests a low‑profile phishing operation that relied on the perceived legitimacy of the hosting environment. Uncertainty remains regarding the exact phishing vector, target brand, or credential‑capture mechanism because the page content was not captured. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration of the same name or similar sub‑domains, and update threat‑intel feeds with the observed indicators (IP 216.198.79.1, name servers, SSL fingerprint). Additional sandbox analysis of any archived payloads, if obtained, would be required to confirm the malicious payload and victim impact.