koipay[.]digital

This domain, koipay.digital, is actively engaged in credential theft operations targeting users of survey and contest platforms. Analysis of the site’s infrastructure reveals it impersonates PulsarInteract, a legitimate service for creating interactive surveys, to deceive victims into entering sensitive login credentials, personal data, or financial information. The fraudulent page title, 'PulsarInteract - Create interactive surveys and contests in minutes,' is designed to lend credibility and lower user suspicion, increasing the likelihood of successful exploitation. Technical indicators confirm the high-risk nature of this domain. VirusTotal reports that 1 out of 95 security vendors has flagged koipay.digital as malicious, while AlienVault OTX lists it in one threat intelligence pulse. The domain was registered on June 24, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with abusive registrations. It resolves to the IP address 188.114.97.3 and appears on one security blocklist, with a Gridinsoft trust score of 0/100. The SSL certificate, issued by Google Trust Services, provides a false sense of security, as encryption does not validate legitimacy. Users who have visited koipay.digital or entered credentials on the site should take immediate action. First, revoke any sessions or logins associated with the domain and change passwords for all accounts that may have been exposed, prioritizing email, financial, and administrative credentials. Enable multi-factor authentication where available to mitigate further risk. Monitor accounts for unauthorized activity, including logins, transactions, or profile changes. If financial data was entered, contact relevant institutions to report potential fraud and request account monitoring. Finally, scan the device used to access the domain for malware or unauthorized modifications, as credential theft sites often deploy secondary payloads.