aktiffkaan-paylattersx[.]resmi-qui4[.]xyz

This domain, aktiffkaan-paylattersx.resmi-qui4.xyz, is identified as a fraudulent Gopay payment portal designed to harvest user credentials through phishing tactics. The site mimics legitimate Gopay login interfaces, tricking victims into entering sensitive financial or personal information, which is then exfiltrated to threat actors. Infrastructure analysis reveals the domain was configured to exploit trust in digital payment systems, a common tactic in credential theft campaigns targeting mobile and online banking users. Evidence supporting this assessment includes multiple technical indicators. The domain was registered on May 02, 2025, through Dynadot LLC, and currently resolves to the IP address 188.114.96.3, hosted on Cloudflare’s network (AS13335). VirusTotal reports that 19 out of 95 security vendors have flagged this domain as malicious, while it appears on at least one security blocklist. Additionally, the SSL certificate is classified as WE1, a low-trust category often associated with ephemeral or suspicious domains. The page title explicitly references Gopay, further confirming its impersonation intent. Users who visited aktiffkaan-paylattersx.resmi-qui4.xyz should immediately revoke any entered credentials and monitor associated accounts for unauthorized activity. It is recommended to reset passwords for Gopay and any other platforms where the same credentials may have been reused. Financial institutions should be notified if payment details were submitted. Devices used to access the domain should undergo a security scan to detect potential malware or backdoors. Given the domain’s current offline status, further interaction is unlikely, but vigilance is advised for similar phishing attempts using comparable infrastructure or naming conventions.