flexibleinstantpay[.]com

flexibleinstantpay.com is currently flagged as a high‑risk social media impersonation site targeting Facebook. The domain was registered on June 23, 2025 through GMO Internet, Inc. and resolves to the IP address 192.3.190.186, which belongs to AS36352 HostPapa in the United States. The web server reports a 302 HTTP redirect and runs Nginx with OpenResty, while the TLS certificate is issued by GoDaddy.com, Inc. under the Go Daddy Secure Certificate Authority – G2. The page title returned by the server is “Flexible Instant Pay”, which does not reference the targeted brand but is consistent with a financial‑themed lure.

VirusTotal analysis shows that one of ninety‑five AV engines flagged the domain, indicating at least a minimal malicious rating. PhishDestroy has already added the domain to its blocklist, and the domain appears on a single external security blocklist. Reputation services rate the site extremely poorly, with Scamadviser scoring 1/100 and Gridinsoft scoring 0/100. Nameservers dns1.webproserver.com and dns2.webproserver.com are in use, and no additional evidence such as Safe Browsing or OTX alerts has been published.

The evidence collectively confirms an active infrastructure used for social media credential harvesting. Defenders should block the domain and its hosting IP at perimeter filters, update URL‑filtering rules to include the observed redirect chain, and monitor for any outbound connections to the HostPapa network. Continuous re‑scanning of the domain with sandbox and reputation services is advised to capture any evolving payloads or changes in the hosting environment.