payfin-shop[.]com

Analysis of payfin-shop.com indicates a phishing domain targeting payment account credentials, currently offline as of July 24, 2026. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and resolves to the IP address 198.177.120.183, hosted on AS22612 (Namecheap, Inc.) in the Netherlands. The page title, 'PAYFIN-SHOP – Аккаунты для совершение платежей,' suggests a focus on offering fraudulent payment accounts, likely aimed at Russian-speaking users. Infrastructure analysis reveals the use of WordPress, MySQL, PHP, Bootstrap, LiteSpeed, and third-party libraries such as Slick, jsDelivr, and jQuery Migrate, a common stack for phishing sites due to its flexibility and ease of deployment. Detection by security vendors remains limited but notable: two of 93 vendors on VirusTotal flagged the domain as malicious, while PhishDestroy has explicitly blocked it.

The domain appears on one security blocklist, reinforcing its classification as a threat. The SSL certificate, issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R36, is valid but provides no inherent trust, as phishing sites frequently use legitimate certificates to appear credible. Nameservers point to Namecheap’s hosting infrastructure (dns1.namecheaphosting.com, dns2.namecheaphosting.com), a common choice for both legitimate and malicious sites due to its affordability and accessibility. The domain’s Gridinsoft trust score of 0/100 further supports its classification as high-risk.

While the exact content and phishing kit used remain unconfirmed, the combination of infrastructure, detection by security tools, and the page title’s focus on payment accounts align with known phishing tactics. Defenders should treat this domain as a confirmed phishing threat, particularly for financial fraud targeting Russian-speaking users.