p2plivepayment[.]com

Analysis of p2plivepayment.com shows a domain created on February 10, 2025 and registered through TuringSign Inc. d/b/a Cosmotown. The domain resolves to IP address 198.12.80.250, which belongs to the HostPapa hosting network (AS36352) located in the United States. The sole public blocklist entry identified is PhishDestroy, indicating the domain has been actively blocked by that service. VirusTotal reports that 13 of 93 scanned security vendors flagged the domain, providing a modest but notable detection rate.

The site presented an HTTP response with the page title "Index of /", a generic directory listing that offers no additional context about the content served. SSL inspection returned a rating of R10, suggesting a low trust level for the TLS certificate. Independent reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, reinforcing the perception of malicious intent. The domain is currently listed as offline, and the risk rating has been assigned as elevated.

While the available evidence confirms phishing‑related activity, the specific payload, target audience, and any associated credential‑ harvesting mechanisms remain unverified due to the lack of detailed page content. Defenders should add the domain and its associated IP to network‑level blocklists, enforce DNS filtering to prevent resolution, and monitor for any residual traffic patterns that may indicate continued usage. Ongoing observation of the hosting provider and any future re‑registration attempts is advised, as threat actors frequently recycle infrastructure after takedown.