# arcpays.xyz — SUSPICIOUS

> arcpays.xyz is an active crypto drainer impersonating payment services. Flagged by 3/95 vendors, avoid transfers. Verify legitimacy via PhishDestroy.

## Summary
PhishDestroy identifies arcpays.xyz as an active crypto drainer impersonating legitimate payment services. The domain employs deceptive tactics to trick users into connecting crypto wallets or initiating transactions, resulting in direct fund extraction. Technical analysis reveals this site leverages a drainer kit designed to intercept wallet connections and execute unauthorized transfers under the guise of a payment interface.

This domain exhibits multiple red flags: VirusTotal detection at 3/95 security vendors, registration through Name.com, Inc., and resolution to IP 34.111.179.208. Its SSL certificate is issued by Let's Encrypt, while Google Safe Browsing classifies it under SOCIAL_ENGINEERING. The domain was created on March 22, 2026, indicating a recent and likely opportunistic campaign.

Current status of arcpays.xyz remains active, with no evidence of takedown. PhishDestroy recommends immediate blocking of both the domain and associated IP. Users are advised to verify any payment-related sites via PhishDestroy’s real-time scanning tool. Despite emerging countermeasures, the risk level remains elevated due to active distribution and recent domain registration.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2026-03-22 03:20:11
- Registrar: Name.com, Inc.
- IP: 34.111.179.208

## Detection Status
- VirusTotal: 3 vendors flagged
- Google Safe Browsing: FLAGGED
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/cc555e57-6f23-439a-becd-f264652101a1
- PhishDestroy: https://phishdestroy.io/domain/arcpays.xyz/
- LLM endpoint: https://phishdestroy.io/domain/arcpays.xyz/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/arcpays.xyz/
Last updated: 2026-03-22