rozum-paycor[.]com

The domain rozum-paycor.com was registered on 21 February 2026 through the registrar NETIM SAS and is delegated to the authoritative name servers ns1.netim.net, ns2.netim.net, and ns3.netim.net. DNS resolution points to the IPv4 address 104.168.101.21, which belongs to the AS36352 network operated by HostPapa and is geolocated in the United States. VirusTotal analysis shows that 11 out of 95 scanned security vendors have flagged the domain, indicating a moderate level of detection across the industry. The site appears on a single public blocklist and is listed by the PhishDestroy blocklist. Independent reputation scoring assigns a Gridinsoft trust score of 0 out of 100, confirming a lack of trust. The TLS certificate is issued by Let’s Encrypt and is valid, which does not mitigate the malicious intent. The web server returns HTTP status code 200 and presents a page title of “Rozum Paycor | Oficiální webový portál Česká republika 2025”. No additional content has been publicly disclosed, so the exact phishing lures or credential‑collection mechanisms remain unverified. The domain is classified as a generic phishing operation and its status is reported as active as of the 12 July 2026 assessment. Defenders should block both the domain and its resolving IP address at network perimeter devices and update DNS filtering feeds with the observed indicator set. Continuous monitoring of the associated IP range and the NETIM name server infrastructure is advised, as the registrar has historically hosted other malicious actors. Incident response teams should treat any credential submissions to this domain as compromised and enforce credential resets for potentially affected users.