md[.]payuev[.]cc

This domain, md.payuev.cc, is flagged as a credential harvesting phishing site with an elevated risk level. Analysis indicates the infrastructure was specifically designed to mimic legitimate financial service portals, likely targeting users through deceptive login interfaces to capture authentication credentials. The domain exhibits multiple high-risk indicators, including its recent creation and association with known malicious infrastructure. Infrastructure analysis reveals the domain was registered on June 12, 2026, through Gname.com Pte. Ltd., a registrar frequently observed in phishing operations. It resolves to the IP address 172.67.175.168, which has been linked to other malicious domains in recent threat intelligence reports. The domain appears on two security blocklists and is actively blocked by multiple threat intelligence feeds. Detection metrics show 6 out of 95 security vendors flagging the domain as malicious on VirusTotal. The SSL certificate, issued by Google Trust Services, provides a false sense of legitimacy while failing to mitigate the underlying threat. To mitigate risks associated with this credential harvesting campaign, organizations should immediately block the domain and its associated IP address at the network perimeter. Security teams are advised to monitor for indicators of compromise, including the domain name, IP address, and any related subdomains. Endpoint protection systems should be updated to detect and prevent access to this infrastructure. Users who may have interacted with the domain should be instructed to reset credentials through verified channels and enable multi-factor authentication on all critical accounts. Network logs should be reviewed for connections to 172.67.175.168 or attempts to access md.payuev.cc within the exposure window.