neptiqpay[.]com

Analysis of neptiqpay.com as of July 27, 2026 shows a newly registered domain created on May 18, 2026 and hosted by HOSTINGER operations, UAB. The domain resolves to the IPv4 address 162.245.237.212 and uses the authoritative nameservers dns1.webproserver.com and dns2.webproserver.com. It appears on a single security blocklist and is actively blocked by PhishDestroy, indicating that at least one downstream protective service has identified it as malicious. VirusTotal records show that the domain has been scanned by 91 antivirus and URL‑reputation vendors; none of those engines currently flag the domain, but the absence of detections does not constitute a safety guarantee.

The domain remains live and responsive, confirming that the infrastructure is still operational. No public evidence of SSL certificate details, HTTP response codes, Safe Browsing or Open Threat Exchange (OTX) entries, trust‑score metrics, or page‑title content is available in the current intelligence set. Consequently, defenders cannot confirm whether the site presents a valid TLS certificate or what content is delivered when accessed.

Given the registration timeframe, hosting arrangement, blocklist inclusion, and the fact that the domain resolves to a single IP address, the infrastructure aligns with typical patterns observed in generic phishing campaigns. Organizations should treat neptiqpay.com as a high‑confidence malicious indicator, enforce URL filtering, and consider adding the domain to internal deny lists. Continuous monitoring for any change in detection status, additional blocklist listings, or emergence of SSL/TLS data is recommended to refine risk assessments.