paylance[.]org

On 24 July 2026 the domain paylance.org was observed offline but retains artifacts indicating a brand‑impersonation campaign targeting the “across” brand. The domain was registered on 21 February 2026 through HOSTINGER operations, UAB and is hosted on the IP address 198.251.89.229, which belongs to AS53667 FranTech Solutions in the United States. DNS resolution uses the authoritative name servers ns1.web2uls.com and ns2.web2uls.com. No SSL certificate is presented, meaning traffic is served over plain HTTP, which can facilitate credential capture.

The site’s HTML title reads “Paylance | AI‑Driven Digital Asset Management”, suggesting an attempt to masquerade as a legitimate digital‑asset‑management service, yet the brand target listed as “across” indicates the campaign aims to deceive users of that brand. Reputation checks show the domain appears on a single blocklist, specifically PhishDestroy, and receives a Gridinsoft trust score of 2 out of 100, reflecting a highly suspicious reputation. VirusTotal analysis recorded a single positive detection among 93 scanning engines, confirming at least one security vendor identified malicious behavior. The limited detection surface—only one blocklist entry and a single VirusTotal flag—leaves uncertainty about the full scope of the infrastructure, such as whether additional domains share the same hosting or whether the payload is delivered via client‑side scripts.

Defenders should add paylance.org to internal blocklists, monitor DNS queries for the associated IP and name servers, and enforce TLS inspection to detect any future traffic if the site is re‑hosted with encryption. Continuous observation of the registrar HOSTINGER operations, UAB for new registrations resembling this pattern is also advised. Because the site is currently offline, any active phishing attempts are likely paused, but threat actors may reactivate the domain or launch similar domains, so proactive controls remain necessary.