drayton-paymill[.]com

The domain drayton-paymill.com was registered on 21 February 2026 through NETIM SAS and is served by the name servers ns1.netim.net, ns2.netim.net, and ns3.netim.net. It resolves to the IPv4 address 104.168.101.21, which belongs to AS36352 operated by HostPapa and is geolocated in the United States. The site presents a valid TLS certificate issued by Let’s Encrypt (YR1) and returns HTTP status code 200. The page title observed is “Drayton Paymill | Official Australia Website 2025”, indicating a brand‑impersonation campaign targeting an Australian entity. The domain appears on a single public blocklist and has been blocked by PhishDestroy. VirusTotal analysis shows that one of ninety‑three scanning engines flagged the domain, and Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. The current risk rating is high and the status remains active. While the underlying page content has not been examined, the infrastructure signals deliberate abuse of a trusted brand name and the use of free SSL to increase credibility. Defenders should add drayton-paymill.com to outbound and inbound filtering rules, monitor DNS queries for the associated host names, and consider sink‑holing the IP address 104.168.101.21. Continuous observation of any new hosting changes or additional detections is advised.