revenue[.]com-payslq[.]vip

The domain revenue.com-payslq.vip was registered through Gname.com Pte. Ltd. on September 26, 2025. It resolves to the IP address 172.67.194.160. A VirusTotal assessment shows that 14 of 91 security vendors have flagged the domain as malicious, indicating a consensus among a subset of scanners that the site is being used for abusive activity.

The domain appears on a single external security blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing its classification as a threat. The threat type is recorded as generic phishing, the risk level is elevated, and the status remains active as of the report date, July 29, 2026. The available intelligence does not include details such as SSL certificate attributes, HTTP status codes, page title, or content analysis, so the exact nature of the phishing payload cannot be described beyond the generic classification.

Infrastructure analysis reveals that the IP address belongs to a large content delivery network, which can be leveraged by adversaries to hide the true origin of malicious servers and to benefit from the CDN’s high availability. Defenders should enforce DNS and proxy level blocking for revenue.com-payslq.vip, incorporate the 14 vendor detection signatures into endpoint detection and response (EDR) policies, and monitor traffic to the hosting IP 172.67.194.160 for any collateral activity. Continuous observation of blocklist status and any changes in vendor detection counts is advised to ensure that mitigation controls remain aligned with the evolving threat posture.