md[.]payuew[.]cc

The domain md.payuew.cc is identified as a credential theft phishing site, currently offline. Analysis indicates the infrastructure was designed to harvest login credentials, likely targeting financial or payment service users. No specific brand impersonation has been confirmed, but the domain structure suggests an intent to mimic transactional or account verification portals. Infrastructure analysis reveals the domain was registered through Gname.com Pte. Ltd. on June 12, 2026, and resolves to the IP address 172.67.175.126. The SSL certificate is issued by Google Trust Services, a common tactic to lend legitimacy to malicious domains. The domain appears on one security blocklist and is flagged by 6 of 95 vendors on VirusTotal, indicating moderate detection but elevated risk due to its recent creation and targeting of sensitive data. The use of a content delivery network IP further complicates attribution and takedown efforts. Current status confirms the domain has been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Organizations are advised to block the domain and associated IP at the network perimeter, update endpoint protection signatures, and conduct retrospective log analysis for connections to 172.67.175.126. Users should be alerted to verify URLs before entering credentials, particularly for financial services, and enable multi-factor authentication where available. Monitoring for similar domains registered through Gname.com Pte. Ltd. with recent creation dates is recommended for proactive threat hunting.