Criticalscore 68 · flagged Tuesday, November 3, 2026

passpay.click

Appeared in the .click zone on Tuesday, November 3, 2026; by the end of that day the census found active website about finance loans. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

TLD with a high abuse rate
matched: click
+8
page impersonates a brand
matched: Netflix
+22
brand in page title, not in the name
matched: netflix
+20
form on a brand-styled page
matched: has_form
+18
Registrar
—
Nameserver provider
Nameservers
ns1.vercel-dns.com, ns2.vercel-dns.com
First-day state
active website
HTTP status
200
Page title
PassPay · Abonnements et cartes de jeu, payés en mobile money
Has a form
yes
Brand echoed
—

Model opinions

Second opinionlooks benignconfidence 66%· claude-opus-5-5

The page carries its own PassPay branding and logo. It is a French-language reseller of Netflix, Robux, PS Plus and other subscriptions, paid by Orange Money or MTN mobile money and ordered over WhatsApp, a common informal-commerce model. The only form is a GET product search to itself, with no credential or payment capture, and the brand names are products it resells rather than an identity it pretends to be.

First passlooks like phishingtarget: Netflixconfidence 92%· claude-haiku-4-5

Page impersonates Netflix by prominently featuring 'Netflix payé en mobile money' and listing Netflix as a primary product, while the domain 'passpay.click' and brand 'PassPay' are independent. The page contains a form posting to itself with no legitimate Netflix integration, and directs users to WhatsApp to confirm purchases—a sealed-room phishing pattern designed to capture payment credentials and personal data under false pretenses.

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Tuesday, November 3, 2026

Screenshot of passpay.click taken by the zone census on 2026-11-03

Same data as JSON: /api/zone/domain/passpay.click. This page is not indexed by search engines and does not link to the site it describes.