gopay7[.]vksy[.]top

This domain, gopay7.vksy.top, poses a high-risk brand impersonation threat specifically targeting GoPay users through a fraudulent promotional campaign. The site falsely advertises a "Hajatan Ulang Tahun GoPay: Bagi-Bagi Saldo Rp500.000 untuk Semua Pengguna" (GoPay Anniversary Celebration: Distribute Rp500,000 Balance to All Users), a tactic designed to lure victims into disclosing sensitive financial information or installing malicious software. Analysis indicates the domain is engineered to mimic legitimate GoPay communications, exploiting user trust in the brand to facilitate credential theft or unauthorized transactions. The fraudulent nature of this campaign is further evidenced by its association with a crypto drainer scheme, where victims may unknowingly authorize transactions that drain digital wallets or linked bank accounts. Infrastructure analysis reveals multiple technical indicators confirming the malicious intent of gopay7.vksy.top. The domain is flagged by 17 out of 95 security vendors on VirusTotal, a significant detection rate that underscores its threat level. It was registered on November 10, 2025, through 阿里云计算有限公司 (Alibaba Cloud Computing Co., Ltd.), a registrar frequently exploited for short-lived malicious domains. The domain resolves to the IP address 188.114.96.3, hosted on Cloudflare’s network (AS13335), a common obfuscation tactic to evade detection. Additionally, the domain appears on one security blocklist and is explicitly flagged for phishing by Google Safe Browsing. The absence of an SSL certificate further signals a lack of legitimate security measures, a red flag for any financial or transactional website. These indicators collectively confirm the domain’s role in a coordinated brand impersonation attack. Users who visited gopay7.vksy.top or interacted with its content should take immediate action to mitigate potential risks. First, cease all engagement with the domain and avoid clicking any links or downloading attachments from it. If credentials or financial information were entered, reset passwords for GoPay and any associated accounts, enabling multi-factor authentication where available. Monitor bank statements and digital wallet transactions for unauthorized activity, reporting any discrepancies to the financial institution immediately. For devices used to access the domain, conduct a full antivirus scan to detect and remove any installed malware. Given the domain’s association with crypto drainer tactics, users should also revoke any suspicious wallet authorizations and review connected dApps for unauthorized access. Organizations should update internal blocklists to include gopay7.vksy.top and its resolving IP (188.114.96.3) to prevent further exposure.