convregepay[.]com

PhishDestroy identifies a phishing operation centered around convregepay.com, a recently registered domain designed to impersonate a legitimate payment processor. This site attempts to trick users into surrendering sensitive financial or login credentials under the guise of processing transactions. While it currently evades detection tools with 0 detections out of 95 scanners on VirusTotal, its malicious intent is revealed by its recent creation date of March 30, 2026, and its association with a registrar known for shielding threat actors. This domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar that has been implicated in previous phishing campaigns. The site operates from IP address 172.67.143.201 and uses a Let's Encrypt SSL certificate—a tactic often leveraged to lend false credibility to fraudulent sites. The combination of a freshly minted domain, low detection rates, and infrastructure commonly abused by cybercriminals underscores the urgency to treat this domain as a high-risk threat. If you or someone in your organization has visited convregepay.com, avoid entering any personal, payment, or login details. Disconnect from the network immediately and scan all affected devices for malware. Report the domain to your security team or ISP to block further access. Proactively block convregepay.com at the firewall and DNS level to prevent additional exposure. Stay vigilant: phishing sites evolve rapidly, and even unflagged domains can pose significant risks to unwary users.