ayonpay[.]com

PhishDestroy identifies ayonpay.com as a cryptocurrency wallet phishing domain currently under investigation for mimicking legitimate crypto wallet services. The site is active and poses a credible threat to users seeking to manage digital assets. The threat involves deceptive design elements such as fake login portals and fraudulent transaction prompts aimed at harvesting wallet credentials and private keys.

This domain was flagged by 3 out of 95 VirusTotal vendors, indicating it has not yet been widely recognized as malicious, despite its recent creation. It was registered on March 22, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, and resolves to IP address 145.14.152.245. Currently, ayonpay.com remains unlisted on major blocklists, and its low trust score reflects its newly established status. The absence of detections suggests a window of opportunity for cybercriminals to exploit unsuspecting users before broader recognition.

The current status of ayonpay.com is active and under investigation, meaning threat intelligence teams are actively monitoring its behavior and infrastructure. Given the lack of widespread detection, users are strongly advised to avoid interacting with this domain entirely. If exposure has occurred, immediately disconnect from the site, scan local devices for malware, and revoke any submitted credentials. Organizations should implement DNS filtering to block access to ayonpay.com and similar newly registered domains. Users are encouraged to verify website authenticity via official channels before entering sensitive information.