ct[.]com-payxuw[.]vip

The domain ct.com-payxuw.vip is identified as a generic phishing resource currently classified as offline. Analysis indicates it was designed to impersonate payment processing portals, likely targeting users through credential harvesting techniques. No specific brand name was confirmed in the available data, but the domain structure suggests an attempt to mimic legitimate financial transaction services. Infrastructure analysis reveals the domain was registered on June 12, 2026, through Gname.com Pte. Ltd. It resolves to the IP address 172.67.202.49 and is flagged by 15 of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services, a common tactic to lend false legitimacy. The domain appears on 2 security blocklists and is actively blocked by multiple threat intelligence feeds. Detection rates and blocklist inclusion confirm its malicious classification. Current status indicates the domain has been taken offline, reducing immediate risk to end users. However, the infrastructure may be reactivated or repurposed. Organizations are advised to add ct.com-payxuw.vip to DNS sinkholes and web proxy blocklists. Endpoint protection systems should be updated to include this domain in phishing detection rules. Users who may have interacted with the domain should reset credentials for any financial or payment-related accounts, particularly if login attempts were made. Network logs should be reviewed for connections to 172.67.202.49 or related subdomains.