1vnpay812.com is an impersonation phishing page dressed up as 1VNPAY. Its Vietnamese title translates to "1VNPAY - Asia's leading payment channel" and is aimed at Vietnamese-speaking users who expect a legitimate payment service. PhishDestroy first flagged it on 2026-09-29. The site has been offline since 2026-10-14 and was still dead when last checked on 2026-10-19.
How the scam works
Payment-brand impersonation works by borrowing the trust people place in a familiar checkout or wallet service. The page presents itself as an official 1VNPAY channel, so victims believe they are logging in, topping up or confirming a transaction with the real provider. Whatever they type goes to the operators: account logins, one-time codes, card or bank details, or money sent to accounts the scammers control. With those credentials and codes, attackers can empty linked balances or reuse the details elsewhere.
Evidence
On 2026-10-07, 14 of 92 VirusTotal engines flagged the domain. The vendors included BitDefender, Kaspersky, Fortinet, Forcepoint ThreatSeeker, G-Data, Gridinsoft, CRDF and alphaMountain.ai. That is a minority of engines, but it is a broad mix of established antivirus and web-filtering vendors reaching the same verdict, which supports our classification. PhishDestroy lists the domain on its own blocklist.
Infrastructure
The domain was registered through GoDaddy.com, LLC on 2025-07-14, more than a year before PhishDestroy detected it on 2026-09-29. That gap suggests the name was held in reserve before it was put to use. Traffic resolved to Cloudflare, Inc. addresses geolocated in Canada, so the real origin server sits behind Cloudflare's network. The certificate came from Google Trust Services (WE1), which means the browser padlock showed nothing about whether the operator was legitimate.
What to do
If you entered a 1VNPAY or banking login on this site, change that password right away from the official app. Also change it anywhere else you reused it, and turn on two-factor authentication. If you shared card numbers, bank details or one-time codes, call your bank to freeze the card, dispute unauthorized charges and watch your statements. Do not send further "verification" or "unlock" payments to anyone claiming to be from the site. Security teams should block the domain and search proxy and DNS logs for earlier visits since 2026-09-29. Watch for look-alike 1VNPAY domains that carry different numeric suffixes.
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Hostnames retained in the domain record or Certificate Transparency cache. A hostname alone does not establish current availability or malicious activity.
www.1vnpay812.comDomain record
The original observation time is not recorded for these hostnames.
使用技術 · 3 identified
V
Vue.js
JavaScript frameworks
Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.
Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
