arcusdex[.]net

arcusdex.net was registered on July 16, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain resolves to the Cloudflare‑owned address 172.67.184.219 and uses the Cloudflare authoritative nameservers dilbert.ns.cloudflare.com and liv.ns.cloudflare.com. As of the report date, the domain remains active and is listed on the PhishDestroy blocklist, with a single additional external blocklist entry. VirusTotal analysis shows that two of ninety‑five scanned security vendors have flagged the domain as malicious, indicating limited but present detection consensus. The limited number of detections suggests the payload or hosting may be newly deployed or employing evasion techniques that have not yet been widely catalogued. No further public intelligence such as Safe Browsing status, OTX mentions, or SSL certificate details is available in the current dataset. The classification provided is generic phishing, and the risk level is high, implying that the domain is likely being used to harvest credentials or other sensitive information. Defenders should proactively block the domain at network perimeter controls, update DNS filtering policies to include the observed IP address 172.67.184.219, and monitor for any traffic to the associated Cloudflare nameservers. Additional telemetry should be collected, including HTTP response codes and page content, to improve detection coverage. Continuous re‑evaluation is recommended, as the detection landscape may evolve with further vendor scans or blocklist additions. Because the site’s page title, SSL fingerprint, and any observed redirect behavior have not been published, analysts cannot confirm the exact phishing vector or target brand. The short interval between registration and detection indicates a rapid deployment, which is typical for opportunistic campaigns.