md[.]payima[.]cc

This domain, md.payima.cc, is flagged as a generic phishing site specializing in crypto wallet credential theft. Analysis indicates the infrastructure mimics legitimate wallet services to deceive users into entering private keys or recovery phrases, likely employing a drainer kit to automate fund transfers. No direct brand impersonation is evident, but the domain name suggests an attempt to appear associated with cryptocurrency platforms, increasing its deceptive potential. Infrastructure analysis reveals the domain was registered on June 12, 2026, through Gname.com Pte. Ltd., a registrar frequently linked to high-risk domains. It resolves to the IP address 188.114.96.3, which has been associated with other phishing campaigns. VirusTotal reports 6 out of 95 security vendors flagging the domain as malicious, and it appears on one security blocklist. The SSL certificate, issued by Google Trust Services, provides a false sense of legitimacy while failing to mitigate the underlying threat. As of the latest assessment, md.payima.cc has been taken offline, reducing immediate exposure. However, the domain remains a residual risk due to its recent registration and historical malicious activity. Users who interacted with the domain should revoke any connected wallet permissions, monitor for unauthorized transactions, and reset credentials for associated accounts. Continuous vigilance is advised, as threat actors may re-deploy similar infrastructure under new domains.