onebitpay[.]top

The domain onebitpay.top was registered on November 08, 2024 through NiceNIC International Group Co., Limited and is currently resolved to the IPv4 address 212.32.225.148, which belongs to LeaseWeb Netherlands B.V. (AS60781) in the Netherlands. No SSL certificate is presented for the site, and an HTTP request returns the page title "Account Suspended," indicating that the infrastructure has been taken offline as of the report date, July 23, 2026. VirusTotal records show that 14 of 95 security vendors have flagged the domain, suggesting malicious behavior, while AlienVault OTX references include the domain in 15 separate threat‑intelligence pulses.

The domain appears on a single security blocklist and is actively blocked by PhishDestroy, confirming that defensive communities have identified it as hostile. The listed nameservers—ns1.steadyhost.ru, ns2.steadyhost.ru, ns8.steadyhoster.com, and ns9.steadyhoster.com—are associated with a Russian‑based hosting provider, which may be used to obscure the true operator. The threat classification is identified as an Account Takeover campaign, a subset of generic phishing that seeks to hijack victim credentials.

Although the site is offline, its historical activity and the presence on multiple detection platforms indicate a credible risk. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the listed nameservers, and consider adding the IP address 212.32.225.148 to reputation‑based deny lists. Ongoing vigilance is advised in case the infrastructure is re‑activated or similar domains are launched by the same threat actor.