gopay46[.]isvn[.]top

This domain is flagged for elevated-risk brand impersonation, specifically targeting GoPay, a digital payment platform. The threat involves luring users with fraudulent offers, such as the page title 'Hajatan Ulang Tahun GoPay: Bagi-Bagi Saldo Rp500.000 untuk Semua Pengguna,' to harvest credentials or financial information. Analysis indicates the domain was registered recently and lacks basic security measures, increasing its potential for malicious exploitation. Infrastructure analysis reveals the domain gopay46.isvn.top was created on February 21, 2026, and is registered through 阿里云计算有限公司 (Alibaba Cloud Computing Co., Ltd.). It resolves to IP address 172.67.136.21, hosted on AS13335 (Cloudflare, Inc.) in the United States. The domain lacks an SSL certificate and appears on one security blocklist. VirusTotal reports 18 out of 95 security vendors flagging the domain as malicious, confirming its association with fraudulent activity. The domain is currently offline, but prior activity suggests it was actively used for brand impersonation campaigns. Mitigation steps for this specific threat type include blocking the domain and its resolving IP (172.67.136.21) at the network perimeter. Organizations should monitor for user interactions with the domain, particularly those involving financial transactions or credential submissions. Security teams are advised to review logs for connections to 172.67.136.21 or related infrastructure. End-users should be educated on recognizing brand impersonation tactics, such as unsolicited offers or requests for sensitive information. If credentials were exposed, immediate password resets and multi-factor authentication enforcement are recommended.