comptroller[.]payflkc[.]cc

Analysis of the domain comptroller.payflkc.cc indicates an active phishing campaign targeting financial or corporate controller services, as suggested by the subdomain 'comptroller'. The domain was registered on June 12, 2026, through Dominet (HK) Limited, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the domain resolves to the IP address 170.106.160.91, which has been linked to other suspicious activities in recent threat intelligence reports.

As of July 29, 2026, the domain appears on one security blocklist, specifically PhishDestroy, and is flagged by 15 of 91 security vendors on VirusTotal, indicating elevated risk but not yet widespread detection. The exact content and target brand of the phishing page remain unconfirmed, as no specific brand or login interface details are available in the current intelligence. However, the naming convention suggests an attempt to impersonate a financial or administrative portal, potentially aiming to harvest credentials or sensitive corporate data.

Defenders should treat this domain as malicious and implement blocking measures at the network and endpoint levels. Organizations are advised to monitor for connections to 170.106.160.91 and review logs for any interaction with comptroller.payflkc.cc. Given the domain's recent registration and limited detection coverage, further monitoring of related infrastructure is recommended to identify emerging threats from the same actor or campaign.