payreceiptonline[.]com

The domain payreceiptonline.com is flagged as a high‑risk generic phishing site. Analysis indicates active hosting and a recent creation date of 21 February 2026. The site returns HTTP 200 and presents a page titled “Human verification”, a common tactic used to delay automated analysis while luring victims into credential submission. The domain was registered through Sav.com, LLC and is served from the IP address 198.251.88.188, which belongs to AS53667 FranTech Solutions located in the United States. DNS resolution uses the authoritative nameservers ns7.asurahosting.com and ns8.asurahosting.com, and the domain’s MX record points to itself (priority 0). TLS is provided by a Let’s Encrypt R13 certificate, confirming a valid HTTPS endpoint despite the malicious intent. Reputation services assign a Gridinsoft trust score of 0 / 100, indicating a complete lack of trust. The domain appears on a single security blocklist and has been listed by PhishDestroy. VirusTotal analysis shows that 2 out of 95 scanning engines flagged the domain, reinforcing the suspicion of malicious behavior. The combination of a fresh registration, low trust score, and active SSL makes the infrastructure attractive for short‑lived phishing operations. Defenders should immediately block payreceiptonline.com at network perimeter and email gateways, and add the associated IP address to deny lists. Continuous monitoring of the AS53667 address space is advised, as similar domains may be deployed from the same hosting provider. Incident response teams should treat any traffic to the domain as potentially compromised and enforce credential change procedures for users who may have interacted with the “Human verification” page.