dubai-chambers-payments[.]com

Analysis of dubai-chambers-payments.com indicates a high-risk credential phishing operation targeting entities involved in cross-border trade under the guise of Dubai Chamber Pay services. The domain, registered on June 27, 2026, presents a page title explicitly referencing 'Dubai Chamber Pay — Cross-border supplier payments for Dubai’s traders,' suggesting an intent to deceive users into believing it is an official payment platform. Infrastructure analysis reveals Cloudflare-hosted nameservers (grannbo.ns.cloudflare.com, ricardo.ns.cloudflare.com) and resolution to 172.67.167.6, an IP address geolocated to Canada under Cloudflare, Inc. The site employs Nginx and OpenResty technologies, common in both legitimate and malicious deployments, but no specific phishing kit has been confirmed in available intelligence. A 301 HTTP redirect is active, which may be used to funnel victims to a secondary malicious endpoint not yet analysed. SSL certification is provided by Google Trust Services (WE1), a neutral indicator as free certificates are routinely abused in phishing campaigns. Four security vendors on VirusTotal flag the domain as malicious, while it appears on one security blocklist and is referenced in a single AlienVault OTX threat intelligence pulse. Registration details point to Fewmoretaps OU (operating as Trustname.com), a registrar previously associated with abusive domain registrations. Defenders should treat this domain as active and malicious, prioritising blocking at DNS and network levels, and monitoring for credential submission attempts or secondary redirects. The exact content of the phishing page remains unconfirmed, but the combination of branding, recent registration, and detection by multiple security sources supports classification as a high-confidence credential phishing threat.