arc-automation-payroll[.]onrender[.]com

PhishDestroy identifies arc-automation-payroll.onrender.com as an ACTIVE generic phishing domain masquerading as a payroll automation portal. The infrastructure is currently engaged in social engineering activities designed to harvest sensitive user credentials under the guise of legitimate financial services automation.

This domain was flagged by Google Safe Browsing under SOCIAL_ENGINEERING with zero detections out of 95 VirusTotal vendors as of the latest scan. Registered through Render Services Inc., it resolves to IP 216.24.57.7, has been flagged by MetaMask and SEAL, has appeared on 2 security blocklists, and holds an SSL certificate issued by Google Trust Services. The domain continues to operate without major AV vendor recognition despite active abuse reports.

Given the active status, zero vendor detection rate, and confirmed engagement in credential harvesting, PhishDestroy assesses this domain as HIGH RISK — particularly to users expecting legitimate payroll portal access. Immediate actions include blocking the domain at network and endpoint levels, inspecting outbound traffic to 216.24.57.7, and conducting user awareness training to prevent interaction with untrusted automation portals. Users who have accessed this domain should change any entered credentials immediately and enable multi-factor authentication on all related accounts.