zenithpay[.]world[.]coinexpressprofittrading[.]xyz

Analysis of zenithpay.world.coinexpressprofittrading.xyz shows a recently registered domain (creation date February 21, 2026) that resolves to the IP address 192.3.190.186. The host is located in the United States and is advertised as belonging to AS36352, the HostPapa network. The site served an SSL certificate graded R10, and the only visible page element was the title "Zenith Pay," which does not directly reference the targeted brand. The domain is flagged for brand impersonation of Mastercard, and security vendors have recorded five positive detections out of ninety-three scans on VirusTotal.

Independent reputation scoring from Gridinsoft assigned a trust score of zero out of one hundred, indicating a high likelihood of malicious use. The infrastructure has been actively blocked by the PhishDestroy service and appears on a single public security blocklist, suggesting that at least one defensive organization has taken mitigation steps. Current monitoring indicates the domain is offline, and the status field explicitly notes that it has been taken offline.

While the available evidence confirms the domain’s association with Mastercard impersonation, the exact content of the landing page, the presence of credential‑stealing forms, or any post‑compromise payload remain unverified due to the offline status. Defenders should therefore continue to block traffic to the IP 192.3.190.186, add the full domain to internal phishing and brand‑protection blocklists, and monitor the HostPapa ASN for any new subdomains exhibiting similar characteristics. Ongoing vigilance is advised, as the registration date suggests the actor may reuse the same hosting provider for future campaigns targeting payment brands.