client-masspay[.]io

This domain, client-masspay.io, is currently active and exhibits multiple indicators of compromise associated with a high‑risk generic phishing campaign that is classified as a crypto drainer. The domain was registered on August 29 2025 through NiceNIC International Group Co., Limited and resolves to the IP address 91.92.241.15, which is located in the Netherlands and belongs to ASN 202412 (Omegatech LTD). The host is served behind Cloudflare, as evidenced by the presence of Cloudflare Browser Insights, Cloudflare services, and HTTP/3 support, and presents a valid Let’s Encrypt/E7 TLS certificate. The site returns an HTTP 302 redirect and the page title observed is “MassPay – Login”, suggesting a credential‑collection page. Reputation data is extremely low: Gridinsoft assigns a trust score of 0 / 100, Scamadviser 1 / 100, and the domain appears on at least one public blocklist and is already blocked by PhishDestroy. VirusTotal scans show that 8 of 95 security vendors flag the domain, and AlienVault OTX references it in a single threat pulse. Nameservers ns1.virtualine.org and ns2.virtualine.org are in use, which are commonly observed in malicious hosting. While the visible page title aligns with the claimed “MassPay – Login” theme, no further content analysis is available, leaving the exact phishing template undocumented. Defenders should treat client-masspay.io as malicious, add the domain and its resolving IP to network deny lists, monitor for DNS queries to the listed nameservers, and consider sinkholing traffic to the IP. Continuous threat‑intel feeds should be consulted for any emerging indicators related to this infrastructure.