getarceus[.]com

This domain, getarceus.com, was registered on 21 February 2026 through NiceNIC International Group Co., Limited. It resolves to the Cloudflare‑owned address 188.114.96.3, which is announced by ASN 13335 and geolocated to the United States. The authoritative name servers are garrett.ns.cloudflare.com and paris.ns.cloudflare.com, indicating that the domain is hosted behind Cloudflare’s reverse‑proxy service. No TLS certificate was observed, and the site was taken offline at the time of analysis, returning no HTTP response. The only visible content, captured before takedown, is the page title “Arceus X Executor – Free Roblox Script Executor for Windows PC”.

This title suggests a malicious offering targeting Roblox players, consistent with the classified “Gaming Scam” label. The domain appears on a single security blocklist and is listed by PhishDestroy as blocked. VirusTotal reports three detections out of ninety‑three scanned engines, confirming the presence of malicious indicators across multiple vendors. Evidence therefore points to a phishing‑style campaign that lures victims with a purported free script executor, likely to deliver malware or harvest credentials.

The lack of SSL, the reliance on Cloudflare, and the brief online window limit immediate visibility, but the registration date and blocklist presence demonstrate an active threat actor. Uncertainty remains regarding the exact payload delivered, the infection vector, and whether additional infrastructure (command‑and‑control servers) is shared with other observed gaming‑related scams. Defenders should block the domain at DNS and proxy layers, monitor for outbound connections to 188.114.96.3, and flag any attempts to download or execute files claiming to be Roblox script executors. Continuous threat‑intel feeds should be consulted for any re‑registration attempts or related indicators of compromise.