arcmessage[.]xyz

Analysis of the domain arcmessage.xyz indicates it was actively involved in wallet seed phishing, a threat type explicitly classified in available intelligence. The domain was registered on November 21, 2025, through Go Daddy, LLC, and resolved to IP address 46.101.232.181, hosted on DigitalOcean, LLC infrastructure (AS14061) in Germany. No SSL certificate was present, increasing the risk of unencrypted credential interception. The page title, 'Arc Message,' aligns with the reported scam type targeting cryptocurrency wallet recovery phrases or seed phrases.

As of the report date, five out of 95 security vendors on VirusTotal flagged the domain, and it appeared on one security blocklist, specifically PhishDestroy. Gridinsoft assigned a trust score of 0/100, further corroborating its malicious classification. The domain is currently offline, though its prior infrastructure remains documented. Nameservers ns43.domaincontrol.com and ns44.domaincontrol.com were used, consistent with Go Daddy’s DNS management.

Defenders should treat this domain as confirmed phishing infrastructure. While the exact content of the phishing page is not analyzed, the combination of detection vendor flags, blocklist inclusion, and the reported scam type provides sufficient evidence for classification. Organizations are advised to block traffic to this domain and monitor for related indicators, including the associated IP and nameserver infrastructure. No evidence suggests this domain is safe for user interaction.