mass[.]hvpay[.]cc

mass.hvpay.cc was registered through Dominet (HK) Limited on 17 September 2025. The domain resolves to the IPv4 address 43.130.77.166 and is currently listed on a single public blocklist. Independent analysis by PhishDestroy has classified the site as a phishing vector, and the reporting system assigns it an elevated risk rating with an active status.

VirusTotal scans show that 13 out of 91 security vendors have flagged the domain as malicious, reinforcing the suspicion that it is being used for credential harvesting or related fraudulent activity. No publicly available metadata such as SSL certificate details, HTTP response codes, Safe Browsing verdicts, or Open Threat Exchange references are present, leaving the full scope of the hosting infrastructure and payload delivery mechanisms uncertain. The absence of disclosed TLS fingerprint or page‑title information means automated content analysis cannot yet confirm the exact phishing template employed.

Defenders should prioritize immediate blocking of the domain and its resolved IP address at network perimeters, incorporate the indicator into DNS‑based filtering solutions, and monitor for any related activity targeting the same IP range. Security teams may also consider sinkholing the IP address and reviewing outbound traffic logs for connections to 43.130.77.166. Continuous re‑evaluation is advised, as additional threat‑intelligence feeds could reveal further associations or new detection signatures, making the domain a candidate for ongoing investigation and containment.