pa[.]payhgfm[.]cc

Analysis of the domain pa.payhgfm.cc indicates it is actively involved in phishing operations targeting payment systems. The domain was registered on June 12, 2026, through Gname.com Pte. Ltd., and currently resolves to the IP address 104.21.95.151. At the time of assessment, the domain is flagged by 6 out of 95 security vendors on VirusTotal, with additional detections from at least two security blocklists. The page title, payhgfm.cc | 521: Web server is down, suggests either a deliberate misconfiguration to evade detection or an attempt to mask its true intent, though the domain remains accessible and operational. Infrastructure review reveals the use of a SSL certificate issued by Google Trust Services, which may lend a superficial appearance of legitimacy but does not mitigate the underlying malicious activity. The domain's trust score, rated 0 out of 100 by Gridinsoft, further corroborates its classification as high-risk. While the exact phishing kit or targeted brand remains unconfirmed, the domain's structure—particularly the 'pa' subdomain—aligns with patterns commonly observed in payment fraud schemes, where subdomains mimic legitimate payment portals to deceive victims. Defenders should treat pa.payhgfm.cc as an active threat. The domain's recent registration, combined with its presence on multiple blocklists and low trust scores, justifies immediate containment measures. Network-level blocking of the domain and its associated IP address (104.21.95.151) is recommended to prevent potential credential harvesting or financial fraud. Monitoring for related subdomains or newly registered lookalike domains under the same registrar may also aid in disrupting broader campaign infrastructure. Given the lack of definitive evidence about the specific phishing payload, further forensic analysis of any captured traffic or user interactions with this domain is advised to determine the exact threat vector.