donate-pay[.]help

Analysis indicates that the domain donate-pay.help was registered on March 17 2026 through Global Domain Group LLC and is currently resolved to the Cloudflare‑provided address 188.114.97.3, which maps to a Cloudflare, Inc. presence in Canada. The domain is served behind Cloudflare’s edge network, as evidenced by the presence of Cloudflare Browser Insights and HTTP/3 support, and it presents a valid Let’s Encrypt certificate (issuer E7). DNS resolution uses the nameservers romina.ns.cloudflare.com and vasilii.ns.cloudflare.com. Reputation data shows a Gridinsoft trust score of 0 out of 100 and inclusion on a single security blocklist, with PhishDestroy explicitly listing the domain as blocked.

VirusTotal scans returned four positive detections out of ninety‑four vendors, confirming that multiple security products have flagged the site. The page title returned by the server is simply “donate-pay.help”, and no further content has been captured because the service has been taken offline. The combination of a recent registration, low trust score, blocklist presence, and multiple vendor detections aligns with the elevated risk rating assigned to the domain.

Defenders should continue to block the domain and its associated IP address at perimeter firewalls and proxy filters, enforce DNS‑based deny‑list rules for the identified nameservers, and monitor for any re‑hosting attempts that may arise from the same Cloudflare account. Because the site is currently offline, future activity may be observed if the attacker reactivates the domain; continuous telemetry on DNS queries and TLS handshakes is recommended. Organizations should also verify that internal URL filtering solutions incorporate the current blocklist entries to prevent accidental access should the domain become reachable again.