# PhishDestroy domain threat record: x-pay.help Content language: English Canonical HTML report: https://phishdestroy.io/domain/x-pay.help/ Machine-readable companion: https://phishdestroy.io/domain/x-pay.help/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-26 16:19:12 UTC - Last availability or vendor check: 2026-10-28 11:03:54 UTC - Stored record updated: 2026-10-28 11:26:25 UTC - VirusTotal detections in the stored snapshot: 0/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 172.67.187.76 - Registrar in stored WHOIS data: Gname.com Pte. Ltd. - Registrar country in stored WHOIS data: SG - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-10-19 23:31:50 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a17911-8cb1-721d-92a3-904393a5870e/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/x-pay.help - Certificate Transparency search: https://crt.sh/?q=%25.x-pay.help - Web Archive lookup: https://web.archive.org/web/*/https://x-pay.help/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy listed x-pay.help on its internal blocklist as a suspicious domain based on an admin report. The domain was first observed on 2026-10-26, six days after its registration on 2026-10-20, and returned HTTP 200 with the page title “Xpay”. How the scam works No malicious forms, wallet prompts, or credential fields were captured; the page only displays the title “Xpay”, which could be meant to resemble a payment service. Without such elements the listing cannot confirm a specific phishing or wallet‑draining technique, leaving only the generic risk that a newly registered domain might be used for deceptive offers. Evidence VirusTotal scanned the domain on 2026-10-21 with 92 engines and reported zero malicious or suspicious detections. Google Safe Browsing checked it on 2026-10-26 and did not flag it, while URLScan captured the site on 2026-10-23 and returned a clean verdict. Cloudflare Radar on 2026-10-26 labeled the domain as “phishing” and noted risks such as “Newly Seen Domains”, OTX had zero pulses, external blocklists showed none, and PhishDestroy’s internal list marks it as blocked. Infrastructure The domain was registered with Gname.com Pte. Ltd. on 2026-10-20 (expires 2027-10-20) and uses Cloudflare nameservers amy.ns.cloudflare.com and cleo.ns.cloudflare.com with A records 104.21.80.228, 172.67.187.76 and AAAA records 2606:4700:3031::ac43:bb4c, 2606:4700:3037::6815:50e4. It presented a Let’s Encrypt certificate for *.x-pay.help valid from 2026-10-20 to 2027-01-18 and was hosted on Cloudflare’s network in Canada; DNSSEC was not enabled and ports 80, 443, 8080 were open. What to do If you entered any credentials on the site, change them promptly and monitor the accounts for unauthorized activity. Defenders should block traffic to x-pay.help, add the domain to threat‑intel feeds, and continue to watch for any future changes. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a17911-8cb1-721d-92a3-904393a5870e/ Cloudflare Radar report: https://radar.cloudflare.com/scan/88510367-6f11-491d-b8a4-28465d047642 Stored capture screenshot: https://urlscan.io/screenshots/01a17911-8cb1-721d-92a3-904393a5870e.png Cloudflare Radar screenshot (2026-10-26T16:30:48Z): https://screenshots.phishdestroy.io/cf/88510367-6f11-491d-b8a4-28465d047642.png URLScan screenshot (2026-10-23T07:55:44Z): https://screenshots.phishdestroy.io/us/01a167c1-fcce-773e-8a03-b941b9df0fc1.png URLScan capture report: https://urlscan.io/result/01a167c1-fcce-773e-8a03-b941b9df0fc1/ VirusTotal report: https://www.virustotal.com/gui/domain/x-pay.help Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=x-pay.help Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-26 16:39:03 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a17911-8cb1-721d-92a3-904393a5870e.png Captured: 2026-10-26 16:37:57 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a17911-8cb1-721d-92a3-904393a5870e.png Captured: 2026-10-26 16:37:57 UTC Source report: https://urlscan.io/result/01a17911-8cb1-721d-92a3-904393a5870e/ - URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a167d0-a7f9-7260-8b82-3e79504c86aa.png Captured: 2026-10-23 08:11:52 UTC Source report: https://urlscan.io/result/01a167d0-a7f9-7260-8b82-3e79504c86aa/ SHA-256: eb7a01a3501c725efd31828df55740fedd50a226bed7e3b2c6be517eec55dfd0 - URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a167c1-fcce-773e-8a03-b941b9df0fc1.png Captured: 2026-10-23 07:55:44 UTC Source report: https://urlscan.io/result/01a167c1-fcce-773e-8a03-b941b9df0fc1/ SHA-256: a0e38569024be5444095d24474302a7bfdcffca6cc7bd227c03a43c2888b73fd - URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a17919-f70e-739a-b4b1-00b3fbdc2f98.png Captured: 2026-10-26 16:45:21 UTC Source report: https://urlscan.io/result/01a17919-f70e-739a-b4b1-00b3fbdc2f98/ SHA-256: ae6ce1b0891d842733678707c28fe33b5a07a5aa7a39be07a4b76ed12ec15532 - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/88510367-6f11-491d-b8a4-28465d047642.png Captured: 2026-10-26 16:30:48 UTC Source report: https://radar.cloudflare.com/scan/88510367-6f11-491d-b8a4-28465d047642 SHA-256: adbcab476e5b7f22567d4766a4d4a506276b3b4adee7dd59119a05ea5f1ac209 - URLQuery: https://screenshots.phishdestroy.io/uq/71a69ebc-da55-4d36-b565-e05f4164f922.png Source report: https://urlquery.net/report/71a69ebc-da55-4d36-b565-e05f4164f922 SHA-256: 9b4da85928d989eb4d92b3397b9c86b574a00e1dc9da8acaf53960f1c5357950 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-26T18:11:40Z", "uuid": "01a17911-8cb1-721d-92a3-904393a5870e", "scanned_at": "2026-10-26T16:37:16Z", "final_url": "https://x-pay.help/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://x-pay.help/", "from": "http://x-pay.help/", "status": 307 } ], "ip": "172.64.80.1", "domains": [ "api.x-pay.help", "plugin-code.salesmartly.com", "bin.bnbstatic.com", "msg.salesmartly.com", "srz.salesmartly.com", "newbasset.s3.ap-east-1.amazonaws.com", "widget.salesmartly.com", "client.salesmartly.com", "api.salesmartly.com", "mix-ads.oss-accelerate.aliyuncs.com", "static.cloudflareinsights.com" ], "ips": [ "47.89.140.29", "104.18.23.242", "104.18.22.242", "3.171.139.89", "13.226.94.38", "3.5.214.180", "52.85.61.56", "172.67.187.76", "104.16.80.73", "172.64.80.1" ], "asns": [ "45102", "13335", "16509" ], "countries": [ "US", "HK" ], "link_domains": [ "www.tradingview.com" ], "doc_hash": "8ace985fdbb870cdb3ffbcb7033dbb3651252ca0b44bf625d182e5dc09efd389", "script_hashes": [ "cb0c6c9f1771d252eee7caa043bdd7cfffbd52c2cc4b18b7be7c4554ed069151", "62414303dc3caba3e1b6c53714fe79a1ea719d2785441992e54bd9ef8b163e86", "5e545c3087378bfa53bbeadbf9178acb2d011d8f1e303c855eba0769c570ad54", "de24d01af18e56461133a28c1f19bcd3c242ea7296ff07b722ad6d6fb5dea7bb", "2ad3e0af83059e4173a388928d315482fdf9556bdf0b20d81f6f3cf67eb7067a", "29de6181f13154b62743ed52e7a928db4ff877d52e5cf41373d8f4e815ed457b", "8685dd592194f86822a10bc2cd8d6f397d9eadd116d1630739f1f908a29cf02b", "96d2749a39b4d6abf12f0448e67a30ad897c62c0ee79455cb8016ef3ed7ef271" ], "globals": [ "TradingView", "__ACChat", "addMeta", "lib", "rem", "dpr", "__VUE_INSTANCE_SETTERS__", "__INTLIFY_PROD_DEVTOOLS__", "__INTLIFY_JIT_COMPILATION__", "__INTLIFY_DROP_MESSAGE_COMPILER__", "__VUE_I18N_FULL_INSTALL__", "__VUE_I18N_LEGACY_API__", "PubSub", "setImmediate", "clearImmediate", "litPropertyMetadata", "reactiveElementVersions", "litHtmlVersions", "litElementVersions", "__config", "__theme", "apiready", "__VUE__", "__cfBeacon", "__ssc", "ssq", "install_ss_chat_plugin", "ss_chat_plugin_version", "__read", "__spreadArray", "__SS_CHAT_RUNTIME__", "__SS_CHAT_SCRIPT_MODE__", "SHOPINFO", "ASSETS_HOSTNAME_VARIABLE", "ASSETS_CDN_HOSTNAME_VARIABLE", "STATIC_HOSTNAME_VARIABLE", "__SS_CHAT_SHADOWROOT__", "ssmEvent", "__VUE_SSR_SETTERS__", "saveAs" ], "cookies": [ "ss_uid", "_ss_s_uid" ], "storage_keys": [ "DERIVA_THEME", "main", "DERIVA_LANGUAGE", "salesmartly_p_g1kwgl3_session_tab_key", "salesmartly_p_g1kwgl3_u_i", "salesmartly_p_g1kwgl3_custom_fields_local_map", "salesmartly_p_g1kwgl3_p_xma_", "salesmartly_p_g1kwgl3_g_uid", "salesmartly_p_g1kwgl3_token_date", "salesmartly_p_g1kwgl3_token", "ss_p_c_l_v_pro", "salesmartly_p_g1kwgl3_n_u" ], "tls": { "san": [ "*.x-pay.help", "x-pay.help" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "x-pay.help", "protocol": "QUIC", "valid_to": "2027-01-18T00:46:38Z", "valid_from": "2026-10-20T00:46:39Z" }, "domain_age_days": 5, "apex_age_days": 5, "tls_age_days": 6, "tls_valid_days": 89, "requests": 107, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 97, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-26T16:33:16Z", "uuid": "88510367-6f11-491d-b8a4-28465d047642", "scanned_at": "2026-10-26T16:30:48Z", "final_url": "https://x-pay.help/", "status": 200, "history": [ { "url": "https://x-pay.help/", "status": 200 } ], "dom_hash": "ef44b577413e567695f6c59d553ecc29e09d5bec7428df5468aeb86758dc8358", "doc_hash": "8ace985fdbb870cdb3ffbcb7033dbb3651252ca0b44bf625d182e5dc09efd389", "phishing_v2": [ "phishing" ], "domain_risks": [ "Newly Seen Domains", "Security Risks", "New Domains" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "api.x-pay.help", "type": "A", "value": "172.67.187.76" }, { "name": "api.x-pay.help", "type": "A", "value": "104.21.80.228" }, { "name": "api.x-pay.help", "type": "AAAA", "value": "2606:4700:3031::ac43:bb4c" }, { "name": "api.x-pay.help", "type": "AAAA", "value": "2606:4700:3037::6815:50e4" }, { "name": "x-pay.help", "type": "A", "value": "104.21.80.228" }, { "name": "x-pay.help", "type": "A", "value": "172.67.187.76" }, { "name": "x-pay.help", "type": "AAAA", "value": "2606:4700:3037::6815:50e4" }, { "name": "x-pay.help", "type": "AAAA", "value": "2606:4700:3031::ac43:bb4c" } ], "dnssec_valid": false, "ip": "104.21.80.228", "whois": { "registrar": "Gname.com Pte. Ltd.", "created": "2026-10-20T01:31:50Z", "expires": "2027-10-20T23:59:59Z", "nameservers": [ "amy.ns.cloudflare.com", "cleo.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-26T16:28:06Z", "analysis_at": "2026-10-21T08:48:33Z", "stats": { "timeout": 0, "harmless": 53, "malicious": 0, "suspicious": 0, "undetected": 39 }, "reputation": 0, "first_seen": "2026-10-20T02:25:04Z", "dns": [ { "ttl": 300, "type": "AAAA", "value": "2606:4700:3037::6815:50e4" }, { "ttl": 300, "type": "A", "value": "172.67.187.76" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3031::ac43:bb4c" }, { "ttl": 21600, "type": "NS", "value": "cleo.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "amy.ns.cloudflare.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "amy.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "104.21.80.228" } ], "dns_at": "2026-10-21T08:48:49Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.x-pay.help", "x-pay.help" ], "issuer": "Let's Encrypt / YE2", "serial": "52e53d2078785104a5e3363672b4f3e0fea", "sha256": "b56c889d15a2b56d2489e32e9dc2b49481db722c2a148f9dd2518a0dbb098972", "subject": "x-pay.help", "valid_to": "2027-01-18T00:46:38Z", "valid_from": "2026-10-20T00:46:39Z" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-26T16:38:07Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "x-pay.help" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-26T16:29:32Z", "first": "2026-10-26T16:29:32Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 2716 }, "social_tags": { "title": "Xpay", "ogImage": "/platform/deriva/logo_144.png?2.0.1793017321335", "ogTitle": "Xpay", "keywords": "Xpay", "themeColor": "#ffffff", "description": "Xpay", "ogDescription": "Xpay" }, "trackers": { "requests": 77, "trackers": [ { "name": "Amazon Web Services", "company": "Amazon", "country": "US", "category": "Hosting", "requests": 4 } ] }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 2, "tls": 97, "wait": 475, "connect": 6, "download": 0 }, "response_ms": 580 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 4115, "co2_grams": 0.0002, "cleaner_than": 91 }, "dns_server": { "ns": [ { "ip": "173.245.59.89", "host": "cleo.ns.cloudflare.com" }, { "ip": "172.64.32.101", "host": "amy.ns.cloudflare.com" } ], "zone": "x-pay.help" }, "location": { "ip": "2606:4700:3031::ac43:bb4c", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Let's Encrypt / YE2", "subject": "x-pay.help" }, "dns": { "A": [ "104.21.80.228", "172.67.187.76" ], "NS": [ "amy.ns.cloudflare.com", "cleo.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"amy.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418104345, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2606:4700:3037::6815:50e4", "2606:4700:3031::ac43:bb4c" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700:3031::ac43:bb4c", "family": 6 }, "redirects": { "chain": [ "https://x-pay.help" ] }, "whois": { "registrar": "Gname.com Pte. Ltd.", "created": "2026-10-20T01:31:50Z", "updated": "2026-10-25T01:35:10Z", "expires": "2027-10-20T23:59:59Z", "status": [ "serverTransferProhibited https://icann.org/epp", "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "amy.ns.cloudflare.com", "cleo.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html" } } } } ```