szybki-paydex[.]com

Analysis of szybki-paydex.com shows a high‑risk, active phishing infrastructure targeting social media users. The domain was registered on 21 February 2026 through NETIM SAS and uses the authoritative name servers ns1.netim.net, ns2.netim.net, and ns3.netim.net. DNS resolution points to IP address 91.236.116.172, an address attributed to a Swedish hosting provider (w1n ltd). The site presents a valid Let's Encrypt TLS certificate (YR1) and returns HTTP 200 for the root URL, with the page title identical to the domain name. Reputation services have assigned a Gridinsoft trust score of 0 out of 100, and the domain appears on at least one public blocklist. PhishDestroy has already flagged the site, and two of ninety‑three VirusTotal scanners have flagged it as malicious. The listed scam type is social media phishing, indicating that the site likely attempts to harvest credentials or personal data via deceptive social‑media‑related messages. No additional content analysis is available, so the exact payload or credential‑capture mechanisms remain unknown. Defenders should immediately block the domain and its associated IP at perimeter and endpoint controls, monitor for related DNS queries, and update URL filtering policies to include the observed hostnames and IP range. Users should be warned not to follow links to szybki-paydex.com or provide any login information, especially if the request originates from social‑media platforms. Continuous monitoring is recommended to detect any evolution of the site’s content or additional infrastructure components.