md[.]payimr[.]cc

This domain, md.payimr.cc, is identified as a credential theft operation designed to harvest user login credentials through fraudulent login portals. Analysis indicates no direct association with known brand impersonation campaigns or crypto drainer kits, but the infrastructure aligns with credential harvesting tactics targeting financial or payment service users. The domain mimics subdomain patterns commonly used by legitimate payment processors, suggesting an intent to deceive users into entering sensitive account details. Infrastructure analysis reveals the following technical indicators: the domain was registered on June 12, 2026, through Gname.com Pte. Ltd., and resolves to the IP address 188.114.97.3. Security vendor detections on VirusTotal stand at 15 out of 95, indicating moderate consensus on its malicious nature. The domain appears on one security blocklist and uses an SSL certificate issued by Google Trust Services, which may lend a false sense of legitimacy to unsuspecting visitors. No Google Safe Browsing (GSB) flags were recorded at the time of assessment. The domain is currently offline, likely due to takedown actions or infrastructure adjustments by the threat actor. While the immediate risk of exposure is reduced, the domain’s registration remains active, and the infrastructure could be reactivated or repurposed. Users who may have interacted with the domain are advised to monitor accounts for unauthorized access and reset credentials for any services accessed during the exposure window. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.