aktiifkanpaylateryy[.]ipk[.]my[.]id

Analysis of the domain aktiifkanpaylateryy.ipk.my.id indicates that it is actively used in a generic phishing campaign. The domain resolves to the IPv4 address 188.114.96.3 and is currently listed on one public security blocklist. Automated scanning by VirusTotal shows that ten of ninety‑one AV engines have flagged the domain as malicious, confirming the presence of suspicious activity despite the limited vendor consensus. The blocklist entry is corroborated by an independent blocklist named PhishDestroy, which has already taken the domain offline in its feed.

No authoritative nameserver information is available; DNS queries return NS_NOT_FOUND, suggesting that the domain may be using dynamic or obscured DNS configurations to evade detection. The limited detection footprint—only a single blocklist and modest VirusTotal rating—means that broader intelligence sources such as Safe Browsing, OTX, or SSL certificate analysis have not yet produced additional indicators. Consequently, the full scope of the phishing infrastructure, including any associated landing pages or credential‑harvesting forms, remains unknown.

Defenders should immediately add aktiifkanpaylateryy.ipk.my.id to outbound and inbound filtering rules, block traffic to its resolved IP address 188.114.96.3, and monitor DNS logs for any resolution attempts. Continuous re‑scanning of the domain with multi‑engine services is advised to capture any escalation in detection rates. Organizations employing email security gateways should also flag messages that reference the domain or its sub‑domains, and incident response teams should be prepared to investigate any credential submissions that may have been directed to this infrastructure.