pa[.]safety-payti[.]vip

Analysis of pa.safety-payti.vip indicates that the domain is actively used for phishing. The domain was registered on June 12, 2026 through Gname.com Pte. Ltd., a registrar that frequently appears in malicious‑infrastructure profiles. DNS resolution points to the IPv4 address 104.21.32.194, confirming that the domain is currently reachable on the public Internet.

VirusTotal scans show that 13 of 91 security vendors flagged the domain as malicious, providing independent confirmation of its threat status. The domain is listed on at least one external blocklist and has been specifically blocked by the PhishDestroy service, suggesting that active mitigation actions are already in place in some security platforms. No additional context such as page title, SSL certificate details, HTTP response codes, or Safe Browsing/OTX entries were observed in the available intelligence, leaving the exact phishing lure and target brand unverified.

The limited exposure data means that the full scope of the campaign—such as the specific credential‑stealing page or associated command‑and‑control infrastructure—remains unknown. Defenders should prioritize immediate containment by adding pa.safety-payti.vip to DNS and URL filtering blocks, monitoring traffic to the resolving IP address for anomalous connections, and correlating any internal logs that reference the domain or its IP. Continuous re‑scanning on VirusTotal and inclusion in broader threat‑intel sharing feeds are recommended to capture any future changes in detection scores or additional blocklist listings.