wzeg3uqa8m[.]my

PhishDestroy has placed wzeg3uqa8m.my into active investigation under the category of generic giveaway phishing; the risk level remains under_investigation while forensic analysis continues. The domain resolves to a single IPv4 address 172.67.157.115 and is served over a Google Trust Services certificate, suggesting attackers have provisioned a superficially legitimate TLS layer to lower user suspicion. Domain creation data shows wzeg3uqa8m.my was registered on January 15, 2026 through Dynadot LLC, a registrar often abused for bullet-drop bulk registrations used in short-lived phishing lures. At the time of analysis, VirusTotal returned 0 detections out of 95 engines, indicating the campaign is still under the radar and has not yet been widely blacklisted or sinkholed. This generic giveaway phishing domain is designed to harvest credentials or payment information under the guise of a prize notification. The absence of detections, coupled with the fresh domain age of a few days, places end-users at elevated risk of successful deception. The Google-issued SSL certificate further lowers visual cues that typically trigger browser warnings, thereby increasing the likelihood of click-through. Given the domain’s single-purpose nature and lack of network reputation, any traffic directed to wzeg3uqa8m.my should be treated as hostile until proven otherwise. Users should immediately block the domain wzeg3uqa8m.my at the host or network level and refrain from clicking any links or entering data. Organizations are advised to add 172.67.157.115 to firewall blocklists and to alert email security gateways using the exact SHA-256 fingerprint of the rogue certificate, which can be obtained from PhishDestroy’s IOC feed. If credentials were entered, users must rotate passwords and enable multi-factor authentication on all related accounts while monitoring for subsequent spear-phishing attempts leveraging the harvested data.