mass[.]kupay[.]cc

The domain mass.kupay.cc has been confirmed as a phishing endpoint specifically targeting PayPal users. Analysis indicates the site was designed to harvest login credentials and financial details through fraudulent payment prompts. As of the latest verification, the domain has been taken offline, though it remains a documented threat in security databases. Infrastructure analysis reveals the domain was registered through Dominet (HK) Limited on June 12, 2026, and resolved to the IP address 104.21.18.120. It was flagged by 6 of 95 security vendors on VirusTotal, with one active entry on security blocklists. The site employed Cloudflare hosting and HTTP/3 protocol, while its SSL certificate was issued by Google Trust Services, a common tactic to appear legitimate. Despite its brief operational window, the domain exhibited high-risk indicators typical of credential theft campaigns. Current status confirms mass.kupay.cc is offline, though residual risk persists for users who may have interacted with the site during its active period. Organizations are advised to block the domain and associated IP (104.21.18.120) at perimeter defenses, and review logs for connections to this endpoint between June 12 and its takedown. End users should reset credentials if exposure is suspected, particularly for financial services. Security teams should monitor for similar domains registered through the same registrar, as threat actors frequently reuse infrastructure patterns.