paynote[.]cloud

On July 23, 2026, analysis of the domain paynote.cloud shows a short‑lived infrastructure that was registered on 21 February 2026. The domain resolves to the IPv4 address 216.24.57.1, which is hosted in the United States and belongs to AS397273 (Render). The TLS certificate presented is identified as WE1, indicating a non‑trusted or self‑signed issuance. The site’s HTML title reads “PayNote – Professional Invoicing for Freelancers | PayNote”, yet threat intelligence flags the domain as a tech‑support scam that impersonates Google.

The domain appears on four public blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—demonstrating that multiple anti‑phishing services have already taken it down. Further corroboration comes from AlienVault OTX, where the domain is referenced in thirteen separate threat‑intel pulses. VirusTotal scans report that fourteen of ninety‑three security vendors flagged the host as malicious, and the Gridinsoft trust score is 0 / 100, reinforcing the malicious assessment.

The overall risk rating is high and the current operational status is offline, indicating that the site has been taken down or is otherwise unavailable. Defenders should continue to block the domain and associated IP address at perimeter filters, update URL and hash feeds with the listed blocklist identifiers, and monitor for any re‑registration attempts that reuse the same registrar or hosting ASN. Because the page content has not been publicly captured, analysts should treat any future resolution of the domain as a potential resurgence of the same tech‑support impersonation campaign targeting Google users.