md[.]payime[.]cc

This domain, md.payime.cc, is flagged as a credential phishing infrastructure designed to harvest financial account login credentials. Analysis indicates no direct association with a specific brand or drainer kit, though the subdomain structure suggests an intent to mimic payment or transactional services. The domain exhibits characteristics typical of phishing campaigns, including short-lived registration and use of content delivery networks to obscure hosting origins. Infrastructure analysis reveals the following technical indicators: the domain is detected by 6 out of 95 security vendors on VirusTotal, registered through Gname.com Pte. Ltd., and resolves to the IP address 172.67.186.108. The domain was created on June 12, 2026, and is currently associated with a Google Trust Services SSL certificate, which may lend a false sense of legitimacy. It appears on one security blocklist and was actively blocked by a specialized phishing detection system prior to takedown. The domain is currently offline, reducing immediate risk to end users. However, residual risk remains due to potential reuse of the infrastructure or migration of the phishing kit to a new domain. Organizations should monitor for related indicators, including the IP address and registrar patterns, and update detection rules to account for this campaign. End users who may have interacted with the domain are advised to reset credentials on any financial accounts accessed during the exposure window and enable multi-factor authentication where available.