md[.]paymra[.]cc

This domain, md.paymra.cc, poses a direct threat as a fraudulent PayPal login portal designed to harvest user credentials. Analysis indicates the site mimics PayPal’s authentication interface, likely employing cloned HTML/CSS assets and fake login forms to deceive victims into submitting their account details. The domain’s infrastructure and timing align with typical credential phishing campaigns, where stolen credentials are later exploited for unauthorized transactions or sold on underground forums. No evidence of embedded malware or crypto-draining scripts was observed in initial scans, but the primary risk remains account takeover and financial fraud via credential compromise. Infrastructure analysis reveals the domain was registered on June 12, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.97.3 and is currently offline, though this status may change. The SSL certificate is issued by Google Trust Services, a common tactic to lend legitimacy to phishing sites. As of the latest scan, 11 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on one security blocklist, PhishDestroy. The creation date discrepancy (2026) suggests either a typo or an attempt to evade detection by appearing as a future-registered domain during initial checks. Users who visited md.paymra.cc or entered credentials on the site should assume their PayPal account details are compromised. Immediate action is required: reset PayPal passwords using a secure device and enable multi-factor authentication if not already active. Monitor the account for unauthorized transactions and review linked payment methods for suspicious activity. If financial data was entered, contact the associated financial institution to report potential fraud and request transaction monitoring. The domain’s offline status does not eliminate risk, as harvested credentials may still be exploited. Organizations should update blocklists to include md.paymra.cc and its resolving IP to prevent future access attempts.