michigan[.]paytnhp[.]vip

The domain michigan.paytnhp.vip was registered on 12 June 2026 through Gname.com Pte. Ltd. and is currently flagged as an active generic phishing infrastructure with an elevated risk rating. VirusTotal records show that fifteen out of ninety‑one scanning engines have raised alerts against the domain, indicating a moderate level of malicious consensus among security vendors. The domain is listed on one public security blocklist and has been explicitly blocked by the PhishDestroy mitigation service, reinforcing the indication of abusive use.

Network resolution points to the IPv6 address 2606:4700:3030::6815:4001, which is hosted on a cloud‑front service that is commonly leveraged for fast‑flux or temporary phishing deployments. No additional public indicators such as SSL certificate details, HTTP response codes, or page title metadata have been published, so the precise content and victim‑targeting tactics remain unknown. However, the combination of recent creation, registrar information, multiple vendor detections, and blocklist presence suggests a deliberate attempt to lure victims, likely through credential‑harvesting messages.

Defenders should add michigan.paytnhp.vip to outbound filtering rules, enforce DNS sink‑holing or NXDOMAIN responses, and monitor for any internal DNS queries to the associated IPv6 address. Continuous re‑inspection of the domain is advised, as threat actors may modify the payload or host additional malicious pages after initial detection.