payuaja[.]com

This domain, payuaja.com, is identified as a credential harvesting phishing site targeting users through document-themed lures. Analysis indicates the domain is currently offline, though it previously hosted active phishing infrastructure. No specific brand impersonation has been confirmed, but the page title 'Document' suggests an attempt to deceive users into submitting sensitive information under false pretenses. Infrastructure analysis reveals the domain was registered on April 12, 2025, through NameSilo, LLC, and resolves to the IP address 188.114.97.3. It has been flagged by 3 of 95 security vendors on VirusTotal and appears on 1 security blocklist. The domain holds a trust score of 0/100 and was referenced in 1 AlienVault OTX threat intelligence pulse. Detection systems previously classified it as generic_phishing, and it was blocked by at least one security provider prior to takedown. The domain is currently offline, though residual risk remains due to its recent registration and prior malicious activity. Organizations are advised to block the domain and its associated IP (188.114.97.3) at the perimeter. Security teams should monitor for related domains registered through the same registrar or resolving to the same IP range. End-user education on document-themed phishing lures is recommended to mitigate future exposure.