comptroller[.]payfghj[.]cc

Analysis indicates that comptroller.payfghj.cc was registered on 12 June 2026 through Dominet (HK) Limited. The domain resolves to the IPv4 address 170.106.160.91. VirusTotal has recorded detections from 15 of 91 security vendors, demonstrating that multiple scanning engines flag the host as malicious. The domain appears on a single public security blocklist and is actively blocked by the PhishDestroy service, confirming that at least one anti‑phishing feed considers it a confirmed threat.

No public information on SSL certificates, HTTP response codes, page titles, or content has been released, so the exact landing page behavior remains unknown. Likewise, the autonomous system, hosting provider, and geographic location of the IP address have not been disclosed in the available intelligence. Given the confirmed phishing classification, the presence on VirusTotal detections, and the active blocklist entry, defenders should treat the domain as hostile.

Recommended mitigation steps include adding comptroller.payfghj.cc to DNS‑based blocklists, configuring firewalls to deny outbound connections to 170.106.160.91, and ensuring endpoint protection solutions are updated to recognize the 15 vendor detections. Continuous monitoring of the IP address for additional malicious activity and periodic re‑query of VirusTotal and other reputation services is advised to capture any changes in detection coverage. Organizations should also educate users about unsolicited communications that reference “comptroller” or similar financial terminology, as the domain name suggests a possible impersonation of a governmental or financial entity.