md[.]payimt[.]cc

This domain md.payimt.cc is assessed as a credential theft infrastructure endpoint designed to capture user login credentials through deceptive interfaces. The site is currently offline, but historical analysis indicates it was used in a generic phishing campaign targeting authentication data entry forms.

Evidence shows the domain was created on June 12, 2026 and registered through Gname.com Pte. Ltd., using SSL certificates issued by Google Trust Services. Infrastructure analysis identifies Cloudflare and HTTP/3 support, and VirusTotal reports 7/95 security vendors flagging the domain.

Users who accessed md.payimt.cc are advised to assume credential compromise risk. Any credentials submitted should be considered exposed and rotated immediately. Affected systems should be checked for unauthorized access, session hijacking, or reuse of stolen credentials across services. Network logs and endpoint telemetry should be reviewed for connections to 172.67.145.13 and related Cloudflare edge traffic patterns.