md[.]payimk[.]cc

The domain md.payimk.cc is identified as a generic phishing resource designed to mimic legitimate payment portals. Analysis indicates the site was actively harvesting user credentials through fraudulent login interfaces before being taken offline. No specific brand impersonation was confirmed, but the infrastructure aligns with common payment-related phishing campaigns. Infrastructure analysis reveals the domain was registered on June 12, 2026, through Gname.com Pte. Ltd., resolving to IP address 172.67.154.117. Security telemetry shows 6 of 95 vendors on VirusTotal flagged the domain as malicious, while it appeared on a single security blocklist. The SSL certificate was issued by Google Trust Services, a detail often exploited to lend false legitimacy to phishing pages. The domain exhibited an elevated risk level due to its recent creation and association with known phishing patterns. As of the latest assessment, md.payimk.cc has been taken offline, though residual risks may persist. Organizations are advised to block the domain and its associated IP at perimeter defenses. Users who interacted with the site should reset credentials for any financial or payment-related accounts, particularly if identical passwords were reused. Network logs should be reviewed for connections to 172.67.154.117 or requests containing the domain string to identify potential compromise.