globalwealtggpay[.]live

The domain globalwealtggpay.live has been confirmed as a brand impersonation site targeting Mastercard users. Analysis indicates the infrastructure was designed to deceive victims into submitting sensitive financial credentials under the guise of a legitimate payment service. The page title, 'Global Wealth Pay,' further reinforces the fraudulent branding, mimicking Mastercard’s corporate identity to enhance credibility. Infrastructure analysis reveals the domain was registered through an intermediary (CC-192-3-190-184-29, ASN: 36352) and resolved to the IP address 192.3.190.186. The SSL certificate was issued by Let’s Encrypt, a common tactic to lend superficial legitimacy to phishing sites. At the time of assessment, 10 of 95 security vendors on VirusTotal flagged the domain as malicious, and it appeared on one security blocklist. The domain’s hosting provider and registrar details align with patterns observed in credential theft campaigns, where ephemeral infrastructure is frequently rotated to evade detection. As of the latest verification, globalwealtggpay.live has been taken offline, likely due to enforcement actions by security providers. However, the risk of reemergence remains elevated given the domain’s prior association with confirmed phishing activity. Organizations and users are advised to monitor for similar domains leveraging Mastercard branding, particularly those with slight misspellings or appended terms (e.g., 'wealth,' 'pay'). Network-level blocking of the resolved IP (192.3.190.186) and its associated ASN (36352) is recommended as a proactive measure. Users who may have interacted with the site should immediately reset credentials and enable multi-factor authentication on financial accounts.