arenaplay[.]com

On 24 July 2026 the domain arenaplay.com was observed serving HTTP 200 responses over a TLS connection secured by a Let’s Encrypt certificate (R13). The host resolves to the IPv4 address 199.59.243.228, which is allocated to Amazon.com, Inc. (AS16509) and geolocated to the United States. The infrastructure stack reported by passive fingerprinting includes Nginx as the web server, Google Cloud as the underlying compute platform, and Google Cloud CDN delivering content. Authority records list ns1.above.com and ns2.above.com as the authoritative nameservers, and the registrar is recorded as PDR Ltd. d/b/a PublicDomainRegistry.com. The page title returned by the server is the literal string “arenaplay.com”, providing no additional context about the site’s purpose.

Reputation signals indicate a high‑risk profile. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy service. Gridinsoft assigns a trust score of 0 out of 100, reflecting a complete lack of confidence in the site’s legitimacy. VirusTotal analysis shows that one of ninety‑three scanned security vendors flagged the domain, confirming at least one independent detection of malicious behavior.

The combination of a generic phishing classification, low trust score, blocklist presence, and the single vendor detection suggests that the site is being used to harvest credentials or otherwise deceive users. However, the limited number of detections and the absence of publicly disclosed payload details leave the exact phishing vector unclear. Defenders should treat the domain as hostile: block network traffic to 199.59.243.228, add the domain to URL filtering and email security policies, and monitor for any related indicators such as the listed nameservers or the Let’s Encrypt certificate fingerprint. Continuous re‑evaluation is recommended in case additional detections emerge.