mail[.]cryptopaylink[.]net

The domain mail.cryptopaylink.net was registered on 21 February 2026 through GoDaddy.com, LLC. DNS resolution points to 72.167.102.161, an address announced by AS26496, also owned by GoDaddy, placing the host in the United States. The site served content over HTTPS using a Let’s Encrypt R12 certificate, indicating a valid TLS chain but also a commonly abused free certificate provider. The page title observed at the time of takedown reads “PayLink — USDT Saving Account — Simple, Flexible USDT Saving”, suggesting the infrastructure was intended to lure victims with a cryptocurrency savings narrative. Automated analysis by VirusTotal recorded detections from six of ninety‑five scanned engines, confirming malicious characteristics. Additional reputation services have assigned a Gridinsoft trust score of 0 out of 100 and the domain appears on a single security blocklist.

The domain was actively blacklisted by PhishDestroy and is currently listed as offline, indicating the operators have removed the service or have been disrupted. Technical fingerprinting identified Apache HTTP Server delivering PHP pages styled with Tailwind CSS, a stack frequently used in phishing kits. Nameserver records point to ns47.domaincontrol.com and ns48.domaincontrol.com, both standard GoDaddy name servers, further corroborating the registrar’s involvement. What remains uncertain is the full scope of victim targeting, the persistence mechanisms employed, and whether additional sibling domains exist. Defenders should immediately add mail.cryptopaylink.net and its resolving IP 72.167.102.161 to URL filtering and outbound traffic block lists.

Monitoring for newly registered subdomains under the cryptopaylink.net zone, especially those using similar naming patterns, is advised. Correlating outbound connections to the identified IP with user authentication logs may reveal compromised accounts.