aktiffkan-paylater[.]rqq[.]my[.]id

aktiffkan-paylater.rqq.my.id is currently active and resolves to the IPv4 address 172.67.146.25. The domain appears to be hosted behind a CDN, as indicated by the IP belonging to a large content‑delivery provider. VirusTotal has recorded detections from 19 of 91 scanning engines, indicating that multiple security products consider the domain malicious. The authoritative name server lookup returned NS_NOT_FOUND, suggesting that the domain’s DNS configuration is either intentionally concealed or misconfigured, which is a common tactic in phishing infrastructure. The threat classification provided is generic_phishing, but no specific target brand or service has been identified in the available intelligence. Consequently, the exact lure or credential‑harvesting mechanism employed by the site remains unknown. Defenders should treat the domain as high‑risk: block DNS resolution and HTTP traffic to the domain, add the IP address 172.67.146.25 to network‑level deny lists, and monitor for any related indicators such as similar sub‑domains or future registrations using the same hosting provider. Continuous re‑analysis is advised to capture any changes in the site’s content, hosting, or detection profile.