md[.]payaeo[.]cc

This domain, md.payaeo.cc, is identified as a credential harvesting phishing portal targeting users through deceptive login interfaces. Analysis indicates the site mimics legitimate authentication pages to capture usernames, passwords, and potentially multi-factor authentication codes. No specific brand impersonation or cryptocurrency drainer kit signatures were detected in initial scans, though the generic phishing infrastructure suggests broad targeting across multiple services. Infrastructure analysis reveals the domain was registered on June 12, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.96.3, which has been linked to other transient phishing campaigns. Detection metrics show 6 out of 95 security vendors flagging the domain on VirusTotal, while it appears on a single blocklist and is currently not listed in Google Safe Browsing. The SSL certificate is issued by Google Trust Services, a common tactic to lend false legitimacy to malicious sites. The domain has been taken offline, likely due to enforcement actions or infrastructure changes by the threat actor. However, the elevated risk level persists due to the domain's recent registration and the registrar's history of hosting malicious content. Users who may have interacted with the site are advised to reset credentials for any accounts entered, enable multi-factor authentication, and monitor for unauthorized access. Organizations should update blocklists to include the domain and IP, while security teams should investigate potential lateral movement from compromised credentials.