financepaybnk[.]xyz

The domain financepaybnk.xyz is a phishing site engaged in brand impersonation targeting Mastercard. It was designed to deceive users into believing they were interacting with an official Mastercard payment portal, posing an elevated risk of credential theft or financial fraud. As of the latest verification, financepaybnk.xyz has been taken offline, though prior activity indicates it was actively used for phishing attempts.

Technical indicators confirm the malicious nature of financepaybnk.xyz. The domain was flagged by 2 of 95 security vendors on VirusTotal, including alphaMountain.ai and Forcepoint ThreatSeeker, and appears on 1 security blocklist (PhishDestroy). Registered through OwnRegistrar, Inc. on April 18, 2025, it resolved to the IP address 192.3.190.186, hosted on AS36352 (HostPapa) in the US. No SSL certificate was present, and the observed page title was 'Finance Pay Bnk'. The domain had only one nameserver configured, further suggesting a disposable infrastructure typical of phishing campaigns.

Users who may have interacted with financepaybnk.xyz should immediately change any passwords entered on the site, particularly for financial accounts, and enable two-factor authentication (2FA) where available. Monitor bank and credit card statements for unauthorized transactions, and report the incident to Mastercard’s fraud department. Additionally, victims can submit the domain to Google Safe Browsing, the Anti-Phishing Working Group (APWG), or their local cybercrime reporting center to aid in takedown efforts and prevent further abuse.