michigan[.]com-payccr[.]vip

Analysis indicates that the domain michigan.com-payccr.vip was registered through Gname.com Pte. Ltd. on June 12, 2026. Within two weeks of creation the domain has already been flagged by seven of ninety‑one VirusTotal scanners, suggesting the presence of malicious payloads or phishing infrastructure. The same domain appears on a single public blocklist and is actively blocked by the PhishDestroy service, confirming that at least one anti‑phishing community has taken mitigation action.

No additional intelligence such as hosting IP address, SSL certificate details, HTTP response codes, or page title has been released, limiting the depth of technical profiling. The limited detection footprint combined with rapid blocklisting is consistent with a newly deployed generic phishing campaign that leverages short‑lived domains to evade reputation‑based defenses. Defenders should immediately add michigan.com-payccr.vip to URL filtering and DNS sink‑hole rules, monitor for any resolver queries to the registrar’s name servers, and correlate traffic logs for connections to the domain’s resolved IPs.

Continuous re‑scanning on VirusTotal and other sandbox services is recommended to capture any evolving payloads. Organizations that receive emails referencing “Michigan” or related identifiers should treat any links to this domain as malicious until a thorough forensic examination proves otherwise. Ongoing intelligence collection should focus on extracting hosting details, TLS fingerprints, and any observed phishing templates to improve detection signatures.