ct[.]com-paynhs[.]vip

The domain ct.com-paynhs.vip was registered through Gname.com Pte. Ltd. and first observed on June 12, 2026. DNS resolution points to the IP address 172.67.216.63, an address associated with Cloudflare’s global edge network, a common hosting choice for fast‑flux and malicious redirectors. VirusTotal reports that twelve of ninety‑one scanned security vendors flagged the domain as malicious, providing a consensus that the site is likely being used for credential harvesting or related phishing activity.

The domain is listed on one public blocklist and is actively blocked by the PhishDestroy service, reinforcing the assessment that it is part of an ongoing threat campaign. No public information about SSL/TLS details, HTTP status codes, page title, or content has been released, so the exact payload and impersonated brand remain unknown. The limited visibility suggests that threat actors may be employing a fast‑deployment model, relying on shared infrastructure and minimal surface exposure to evade rapid takedown.

Defenders should treat ct.com-paynhs.vip as a high‑confidence malicious indicator: add the domain to network and endpoint URL filtering policies, monitor DNS logs for queries to the associated IP range, and consider enriching detection rules with the observed VirusTotal vendor count. Continuous observation of the hosting IP, correlation with email phishing campaigns, and periodic re‑scanning of the domain will help clarify the scope of the operation and enable timely remediation.