m[.]securepay[.]club

The domain m.securepay.club is an active credential-phishing site designed to steal login credentials from victims. It does not impersonate a specific brand or use a known drainer kit but presents itself under the generic name 'SecurePay'. As of the latest verification, the site remains operational, posing an elevated risk to users who may enter sensitive information such as usernames, passwords, or other authentication details.

Technical indicators confirm the malicious nature of m.securepay.club. The domain is flagged by 2 of 95 security vendors on VirusTotal, including alphaMountain.ai and SOCRadar, and appears on one security blocklist (PhishDestroy). It was registered on March 29, 2025, through Key-Systems LLC and resolves to the IP address 172.67.143.51, hosted by Cloudflare, Inc. (AS13335) in the US. The site uses an SSL certificate issued by Google Trust Services and employs technologies such as HSTS, Cloudflare Browser Insights, and HTTP/3. Despite these security features, the page returns an HTTP 403 status, and no valid SSL issuer details were available at the time of analysis.

Users who may have interacted with m.securepay.club should immediately change any passwords entered on the site and enable two-factor authentication (2FA) on all affected accounts. Monitor accounts for unauthorized activity and report any suspected fraud to financial institutions or relevant service providers. To report the phishing domain, submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group (APWG). Victims can also notify their local cybercrime authorities or use tools like URLVoid to verify the domain's reputation.