A new phishing campaign abuses the .arpa TLD to host malicious content and hides its location via Cloudflare’s infrastructure.