vicpayments[.]com

This domain, vicpayments.com, is actively impersonating VicPay, a money-transfer service, as part of a high-risk phishing operation. Registered on February 21, 2026, through a Russian registrar, the domain resolves to 172.67.183.241, an address hosted on Cloudflare's infrastructure in the United States. The site presents itself as 'VicPay - Your Partner in World Wide Money Transfer,' a title designed to mimic legitimate financial platforms and deceive users into entering sensitive credentials or payment details. Analysis indicates the domain is flagged by one security blocklist and appears in a single threat intelligence pulse on a major open-source platform. The site returns a standard HTTP 200 status, suggesting it is fully operational, and employs a Let's Encrypt SSL certificate to create a false sense of legitimacy. Detected technologies include Stripe for payment processing, Nginx as the web server, and Google Analytics for traffic monitoring, all of which are commonly used in both legitimate and malicious sites. While only one out of ninety-five security vendors on a widely used scanning platform currently flags the domain, this does not indicate safety, as phishing infrastructure often evades detection during initial deployment. Infrastructure review reveals the domain uses Cloudflare nameservers, a common tactic to obscure hosting origins and complicate takedown efforts. The low trust score of 27 out of 100 further supports the assessment of malicious intent. Defenders should treat this domain as active and high-risk, particularly in environments where financial transactions or user authentication occur. Immediate actions include blocking the domain at the DNS or proxy level, monitoring for internal connections to 172.67.183.241, and alerting users to the presence of this impersonation attempt. Given the use of Stripe, security teams should also review logs for unauthorized payment attempts linked to this domain.