pay1tube[.]com

This domain is flagged as a credential harvesting phishing site designed to impersonate legitimate video streaming login portals. Analysis indicates pay1tube.com specifically targets users of video platforms by presenting a fraudulent login interface under the page title 'PayVid.' The site employs tracking and analytics tools, including Facebook Pixel, Google Analytics, and ShareThis, to monitor victim interactions and optimize the phishing workflow. The use of Vue.js and Inertia.js suggests a dynamic frontend designed to mimic legitimate authentication flows, increasing the likelihood of successful credential capture. Infrastructure analysis reveals the domain was registered on April 11, 2026, through HOSTINGER operations, UAB, a registrar frequently associated with low-cost hosting and bulk domain registrations. The domain resolves to the IP address 188.114.96.3, which has been observed in other phishing campaigns. Detection metrics show 3 out of 95 security vendors on VirusTotal have flagged pay1tube.com as malicious, while it appears on one security blocklist and is actively blocked by at least one anti-phishing system. The combination of recent registration, low detection rates, and targeted impersonation of video platform credentials contributes to an elevated risk assessment. Users who visited pay1tube.com or entered credentials on the site should immediately revoke any submitted login details from the legitimate service being impersonated. Password changes should be performed on a separate, verified device to prevent session hijacking. Browser cache and saved credentials should be cleared to remove any residual phishing artifacts. Network-level monitoring for connections to 188.114.96.3 or the domain pay1tube.com is recommended to identify potential compromise. Organizations should update blocklists to include this domain and IP to prevent further exposure.