padronepay[.]com

This domain, padronepay.com, is classified as an elevated-risk brand impersonation phishing site. Analysis confirms the domain was specifically engineered to mimic the Across brand, leveraging deceptive page titles such as 'Padrone Pay Bank' to mislead users into divulging sensitive financial or personal credentials. The threat type—brand impersonation—exposes victims to credential harvesting, unauthorized transactions, or identity fraud, with potential downstream impacts including account takeovers and financial loss. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on February 21, 2026, through Cosmotown, Inc., a registrar frequently associated with phishing campaigns. It resolves to the IP address 173.0.59.2, hosted under AS27323 (Wowrack.com) in the United States. At the time of assessment, 9 out of 95 security vendors on VirusTotal flagged the domain as malicious. The domain appears on at least one security blocklist and is actively blocked by enterprise-grade detection systems. The SSL certificate, issued by Let’s Encrypt (R13), provides baseline encryption but does not mitigate the inherent fraudulent intent of the site. The domain’s current status is offline, though historical resolution and detection data remain relevant for retrospective threat hunting. Mitigation against brand impersonation threats requires a multi-layered defense strategy. Organizations should implement domain monitoring to detect newly registered lookalike domains, particularly those mimicking high-value brands. Endpoint and network-level protections should be configured to block known malicious IPs, such as 173.0.59.2, and domains flagged by multiple security vendors. User awareness training should emphasize the risks of interacting with unsolicited financial or brand-related communications, particularly those directing users to domains with anomalous registration dates or suspicious infrastructure. Security teams are advised to review logs for connections to the identified IP and domain, and to update detection rules to include the provided indicators of compromise.