arcpayai[.]xyz

This domain arcpayai.xyz was created on 21 February 2026 via NameCheap, Inc. and is currently taken offline. The site served a page titled “Arc Transfer — USDC & EURC on Arc” and delivered HTTP 200 responses over a TLS certificate issued by Let’s Encrypt (R13). Infrastructure analysis shows the domain resolves to 76.76.21.21, an address owned by Amazon.com, Inc. (AS16509) located in the United States. The hosting environment reports Vercel and the presence of HTTP Strict Transport Security.

Gridinsoft assigned a trust score of 0 / 100, indicating no confidence in the site’s legitimacy. The payload is identified as an “Airdrop Scam” phishing kit, a common vector for crypto‑related credential harvesting. VirusTotal recorded nine positive detections out of ninety‑three scanners, and the domain is listed on at least one external blocklist. PhishDestroy has also flagged the site, confirming its malicious intent.

The combination of a recent registration, low trust score, active TLS, and the use of a reputable CDN suggests a fast‑deployment strategy typical of opportunistic phishing campaigns. Uncertainty remains regarding the current activity because the site is offline, limiting observation of any credential‑collection forms or redirects. Defenders should continue to block the domain at perimeter filters, update DNS‑based blocklists, and monitor the associated IP address for any future reuse. Incident response teams should treat any alerts referencing arcpayai.xyz as high‑confidence phishing indicators and correlate them with user reports of unsolicited crypto transfer requests.