md[.]paymro[.]cc

This domain, md.paymro.cc, is identified as a credential harvesting phishing site designed to mimic legitimate payment portals. Analysis indicates the infrastructure lacks explicit branding but employs social engineering tactics to deceive users into submitting sensitive financial information, including login credentials and payment details. No specific drainer kit signatures were observed in initial scans, though the domain exhibits characteristics consistent with generic phishing frameworks targeting e-commerce or fintech sectors. Infrastructure analysis reveals the domain was registered on June 12, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.96.3, which is part of a network known for hosting anonymized content delivery services. The domain is protected by an SSL certificate issued by Google Trust Services, a common tactic to lend false legitimacy. Detection metrics show 6 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on a single security blocklist. No detections were recorded in Google Safe Browsing at the time of analysis. The domain has since been taken offline, likely due to enforcement actions or hosting provider intervention. However, the elevated risk persists due to the domain's recent registration and the registrar's history of facilitating phishing campaigns. Users who may have interacted with the site are advised to monitor financial accounts for unauthorized activity and rotate credentials for any services accessed during the exposure window. Organizations should update endpoint protection rules to block the domain and its associated IP, while security teams are encouraged to investigate potential lateral movement from compromised credentials.