payment[.]mrb-loan[.]com

The domain payment.mrb-loan.com was registered on February 21, 2026 through Tucows Domains Inc. and is currently listed as offline. DNS resolution points to the IP address 185.246.128.50, which belongs to AS42237 w1n ltd and is geolocated to Sweden. The authoritative nameservers are ns1.renewyourname.net and ns2.renewyourname.net, both typical of low‑cost domain forwarding services. An SSL certificate issued for the host carries an E5 grade, indicating weak cryptographic parameters and an overall low security posture.

Public reputation services assign the domain near‑zero trust: Scamadviser scores it 1 out of 100 and Gridinsoft rates it 0 out of 100. The site appears on a single security blocklist and has been actively blocked by PhishDestroy. VirusTotal analysis reports that 14 of 93 scanning engines flag the domain as malicious, reinforcing the suspicion of abusive activity.

The page title returned by the server, "Mirozam Bank | Электронный кошелёк," suggests a financial‑themed landing page, yet the brand target identified in intelligence is the cryptocurrency platform zora. This mismatch indicates a classic brand impersonation attempt, where the attacker likely leverages the familiar name to lure victims into credential harvesting or financial fraud. The elevated risk rating reflects the combination of low trust scores, multiple vendor detections, and the presence of a brand‑specific impersonation vector.

Defenders should continue to block resolution of payment.mrb-loan.com at the network perimeter, monitor the associated IP range for any resurgence, and update endpoint and browser protection tools with the latest blocklist entries. Threat hunters may also query historical DNS and certificate transparency logs to uncover any prior activity tied to the same IP or name server set.