michigan[.]safety-paysq[.]vip

Analysis of the domain michigan.safety-paysq.vip indicates it is part of an active generic phishing infrastructure. The domain was registered on June 12, 2026 through Gname.com Pte. Ltd., a registrar known to host a range of short‑lived malicious sites. VirusTotal data shows that 10 of 91 security vendors have flagged the domain, suggesting that multiple detection engines have observed malicious behavior associated with it.

The site is currently listed on a single security blocklist and has been explicitly blocked by the PhishDestroy mitigation service, confirming that defensive platforms are already treating it as hostile. No public information is available regarding the hosting IP address, autonomous system number, SSL certificate details, or HTTP response codes, leaving those aspects of the infrastructure unverified at this time. The absence of additional intelligence such as page titles, brand impersonation cues, or kit signatures limits the ability to attribute a specific campaign or payload, but the detection footprint and rapid blocklisting point to a typical credential‑harvesting operation.

Defenders should update URL filtering rules to include michigan.safety-paysq.vip, enforce strict outbound web traffic monitoring, and consider pre‑emptive blocking at network perimeters. Incident response teams should flag any authentication attempts to this domain as suspicious and isolate compromised credentials. Continuous monitoring of the registrar Gname.com Pte. Ltd. for new registrations can provide early warning of similar domains, while periodic re‑scans on VirusTotal and other sandbox environments may reveal additional malicious characteristics as they emerge.