paymarket-check[.]gotivkaa[.]workers[.]dev

This domain, paymarket-check.gotivkaa.workers.dev, operates as an active credential harvesting platform targeting users of financial services. Analysis indicates the site mimics legitimate payment verification portals to collect sensitive login credentials, including usernames, passwords, and potentially multi-factor authentication codes. The infrastructure is designed to appear as a legitimate transaction validation service, increasing the likelihood of successful deception among users expecting payment-related communications. Infrastructure analysis reveals the domain is hosted on IP address 172.67.193.138, registered through Cloudflare, Inc. (AS13335). Security telemetry shows minimal detection, with only 1 out of 95 security vendors flagging the domain on VirusTotal. The SSL certificate is issued by Google Trust Services (WE1), providing a false sense of security. The domain appears on one security blocklist and is actively blocked by PhishDestroy. The page title, ksafos9-fwq921.shop | 522: Connection timed out, suggests a secondary or fallback domain structure, potentially indicating rapid domain rotation tactics. Users who have visited paymarket-check.gotivkaa.workers.dev should immediately revoke any entered credentials, particularly for financial accounts. It is recommended to monitor all associated accounts for unauthorized transactions and enable additional authentication measures. System administrators should update network security policies to block the IP address 172.67.193.138 and the domain across all endpoints. Organizations should review logs for connections to this infrastructure and conduct user awareness training on recognizing credential harvesting attempts.