fitur-aktivasipay[.]paylater[.]buzz

This domain, fitur-aktivasipay.paylater.buzz, is assessed as a high-risk generic phishing threat as of July 28, 2026. It remains active and is flagged by 19 of 91 security vendors on VirusTotal, indicating broad detection across the security industry. Google Safe Browsing marks the domain for social engineering, reinforcing its malicious intent. The domain resolves to IP address 104.21.85.56, which is associated with Cloudflare, a common hosting provider used for both legitimate and malicious purposes; no specific ASN or country information is available in the supplied intelligence. Nameservers are not found, suggesting either a misconfiguration or deliberate obfuscation of DNS infrastructure.

The domain appears on one security blocklist and is specifically blocked by PhishDestroy, a dedicated anti-phishing service. The exact page title and brand target are not recorded in the known intelligence, so the specific brand being impersonated is unknown; the domain name includes 'paylater' and 'fitur-aktivasi', which may suggest a payment or activation service, but no brand can be confirmed from the data alone. Registrar details, SSL certificate status, HTTP status codes, and trust scores are not provided, limiting further analysis of the domain's operational setup. Defenders should treat this domain as an active phishing threat and block access at the network level, particularly on email gateways and web proxies.

Organizations should monitor for any outbound connections to this domain or its IP, and users should be warned not to interact with it. Continuous monitoring is recommended, as the domain may change IP addresses or hosting providers. No evidence links or OTX pulse data are present in the intelligence to provide additional context. The domain's continued activity and multi-vendor detection confirm its malicious nature, but the lack of detailed content analysis means the exact phishing campaign remains uncharacterized.