arcpayment[.]net

PhishDestroy identifies arcpayment.net as an active credit card phishing domain currently engaged in fraudulent transactions. The site masquerades as a payment processor to harvest sensitive payment card information from unsuspecting users. Due to the domain’s operational status and low detection rate, users should treat interactions as high-risk and avoid any form of engagement. This domain was flagged by 2 of 95 VirusTotal security vendors, indicating limited but confirmed malicious activity. It is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, resolves to IP address 172.67.128.170, and holds a Let’s Encrypt SSL certificate. The domain was created on March 28, 2026, highlighting its recent emergence as a threat vector. With only 2 vendors detecting the threat and no established reputation, this domain poses an elevated risk to users who may encounter it through phishing emails, fake ads, or compromised websites. Given the domain’s active status and its use in credit card theft campaigns, PhishDestroy recommends blocking arcpayment.net at the network level and removing any saved credentials associated with the site. Users should report the domain to their security teams and avoid clicking links or entering data. Organizations are advised to monitor outbound traffic for connections to 172.67.128.170 and audit logs for signs of compromise linked to this domain.