revenue[.]safety-payag[.]vip

This domain is flagged for hosting a fake payment portal phishing campaign targeting financial transaction credentials. Analysis indicates the threat type as generic_phishing with an elevated risk classification due to its active credential harvesting infrastructure. The domain was operational until recently taken offline, posing a significant risk to users who may have interacted with it during its active period. Infrastructure analysis reveals the domain revenue.safety-payag.vip was registered on June 12, 2026, through Gname.com Pte. Ltd. It resolves to the IP address 172.67.186.252 and utilizes an SSL certificate issued by Google Trust Services, which may lend an appearance of legitimacy. Detection metrics show the domain is flagged by 7 out of 95 security vendors on VirusTotal and appears on one security blocklist, specifically PhishDestroy. The domain's creation date suggests a short-lived operation, consistent with phishing campaigns designed to evade prolonged scrutiny. Mitigation against this specific threat involves immediate domain blocking at the network perimeter, particularly for endpoints resolving to 172.67.186.252. Organizations should deploy email filtering rules to quarantine messages containing references to safety-payag.vip or its subdomains. End-user education should emphasize verifying payment portal URLs against official sources, especially when prompted for financial credentials. Security teams are advised to monitor for unauthorized access attempts from internal IPs that previously resolved to the malicious domain, as this may indicate compromised accounts requiring credential reset and forensic analysis.