michigan[.]safety-payln[.]vip

Analysis indicates that the domain michigan.safety-payln.vip was registered on 12 June 2026 through Gname.com Pte. Ltd. The domain resolves to the IPv4 address 172.67.171.177. VirusTotal reports that eight of ninety‑one scanning engines have flagged the domain, providing the first independent maliciousness indicator. The domain is listed on a single public blocklist and is actively blocked by the PhishDestroy service, confirming that threat‑intel feeds consider it hostile. No additional public evidence such as page title, SSL certificate details, or HTTP response codes is currently available, limiting visibility into the exact phishing payload or credential‑harvesting technique employed.

The limited age of the domain (approximately six weeks at the time of reporting) and its rapid appearance on a blocklist suggest a purpose‑built deployment rather than a long‑standing infrastructure. Defenders should immediately add michigan.safety-payln.vip to URL filtering rules and denylist the associated IP address 172.67.171.177 at network perimeter devices. DNS logging should be enabled to detect any internal resolution attempts, and any observed traffic to the IP should be inspected for exfiltration of credentials.

Continuous monitoring of VirusTotal and other sandbox feeds for updated detection counts is advised, as additional scanners may later flag the site. Correlation with other domains hosted on the same IP may reveal a broader campaign. Until further forensic artefacts become available, the domain should be treated as a confirmed phishing vector and blocked across enterprise controls.