michigan[.]safety-payai[.]vip

This domain, michigan.safety-payai.vip, was registered through Gname.com Pte. Ltd. on June 12, 2026. VirusTotal analysis shows that seven of ninety‑one scanning engines have flagged the domain for malicious activity, indicating a moderate level of consensus among security vendors. The site is currently listed on a single public blocklist and has been added to the PhishDestroy sink‑hole, confirming that at least one specialized anti‑phishing service has taken containment action.

No additional infrastructure details such as hosting IP address, autonomous system number, SSL certificate information, or HTTP response codes are publicly available at the time of this assessment, leaving the broader network footprint uncertain. The lack of further observable attributes suggests that the operator may be leveraging transient or privacy‑focused hosting, a common tactic for short‑lived phishing campaigns. Defenders should proactively block the fully qualified domain name at perimeter firewalls, DNS resolvers, and proxy devices.

Continuous monitoring of DNS query logs for the domain and its potential subdomains is advised, as well as the inclusion of the domain in threat‑intel feeds used by security information and event management (SIEM) platforms. Given the recent creation date, the domain may be part of a targeted, time‑sensitive campaign; therefore, organizations should also review recent user‑reported phishing attempts that reference Michigan‑related services or the “safety‑payai” keyword. Until additional intelligence becomes available, the domain should be treated as malicious and excluded from any trusted allow‑list.