exim-pay.online
Appeared in the .online zone on Wednesday, October 21, 2026; by the end of that day the census found active website about e-commerce & retail. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
The page is a self-branded Russian top-up reseller (EXIM PAY, operated by the Kyrgyz LLC ОсОО «Эксим Нарын») for Steam, PlayStation and Apple balances, with a public offer and a data-consent link. It asks only for a Steam login and an email, explicitly says it never asks for a password, Steam Guard code or card data, and takes payment by bank QR code, so it is not pretending to be Steam or Apple.
The page impersonates Steam, PlayStation, and Apple as a payment service to capture user credentials (Steam login, email addresses). The form requests Steam login username and email for account top-ups, with the page branded as 'EXIM PAY' but prominently featuring the three brand names in the title and offering to 'replenish' their accounts—a classic credential-harvesting phish that exploits users seeking legitimate account funding.
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Wednesday, October 21, 2026
Same data as JSON: /api/zone/domain/exim-pay.online. This page is not indexed by search engines and does not link to the site it describes.