znlyanind-paylterxn[.]tiaoxsid[.]my[.]id

znlyanind-paylterxn.tiaoxsid.my.id was registered on 2026-06-08. Within weeks of its creation the domain began appearing in security tooling. VirusTotal records show that 18 of 91 scanning engines have generated a detection for the domain, indicating that a notable portion of the community considers it malicious. The same domain is listed on a single public blocklist and is actively blocked by the PhishDestroy sinkhole, confirming that at least one anti‑phishing organization has taken enforcement action.

The threat classification supplied is generic phishing, and the risk level has been assigned as elevated with the current status marked as active. Analysis of the available telemetry does not reveal additional infrastructure details such as hosting IP, ASN, or TLS configuration, and no page title or content snapshot is presently available. Consequently, the precise phishing campaign vector, targeted brand, or credential‑stealing mechanism cannot be confirmed at this time.

The limited evidence set nonetheless provides sufficient confidence to treat the domain as hostile. Defenders should ensure that any outbound connections to this FQDN are denied at the network perimeter, update DNS filtering policies to include the domain on blocklists, and monitor endpoint security logs for any attempted resolution or HTTP requests. Continuous re‑evaluation is advised, as future scans may uncover further malicious indicators or expand the detection count.