pay[.]gammpay[.]com

The domain pay.gammpay.com was observed on 2026-07-12 as an active generic phishing site. It resolves to the IPv4 address 13.248.169.48, which is hosted in Canada through Amazon Web Services Global Accelerator. The domain was registered on 2026-02-21 via UdomainName.com LLC and uses the Afternic name servers ns1.afternic.com, ns2.afternic.com, and verification-d3jclucsp89ganyqbydeny.ns. No SSL certificate is presented, and an HTTP GET returns status code 200. MX records are empty, indicating the domain is not used for legitimate mail delivery.

The infrastructure profile shows a Gridinsoft trust score of 0 out of 100 and a presence on a single security blocklist. VirusTotal analysis reports that 2 of 95 scanned security vendors flagged the domain as malicious, reinforcing the suspicion raised by other indicators. The domain is already listed by the PhishDestroy blocklist, confirming that it has been identified by external remediation services.

While the available data confirms the domain’s malicious intent, the exact phishing payload, targeted brand, or victim interaction flow has not been publicly disclosed. No page title, brand name, or specific scam kit information is available, limiting attribution to a generic phishing classification. The lack of an SSL certificate and the use of a cloud-based accelerator suggest the operators aim to hide the origin of the hosting while maintaining a simple HTTP endpoint.

Defenders should add pay.gammpay.com and its resolved IP 13.248.169.48 to outbound and inbound deny lists at network and DNS layers. Monitoring for new sub-domains under the same registrar and name-server set is advised, as the threat actor may proliferate additional look-alike domains. Continuous re-scanning of the domain on multi-engine services is recommended to capture any changes in classification or additional indicators of compromise. Logging of any HTTP requests to the domain can provide early warning of attempted victim interaction.