pasastesintag[.]pics

The domain pasastesintag.pics is currently active and classified as a high‑risk generic phishing site. HTTP requests receive a 403 Forbidden response, and the TLS certificate is issued by Google Trust Services under the WE1 issuer, indicating use of standard Cloudflare TLS termination. DNS resolution points to 188.114.97.3, an IP address owned by Cloudflare, Inc. and geolocated to Canada. The domain is registered through Spaceship, Inc. and uses Cloudflare’s authoritative nameservers nero.ns.cloudflare.com and poppy.ns.cloudflare.com. Threat intelligence sources show the domain has been blocked by PhishDestroy and appears on one public blocklist. VirusTotal records indicate that 17 of 91 security vendors have flagged the domain, and AlienVault OTX references it in seven distinct threat‑intel pulses. The limited visible content (403 page title) prevents confirmation of a specific phishing payload or lure, leaving the exact credential‑stealing mechanism uncertain. Defenders should add the domain and its resolving IP to network‑level deny lists, monitor for any associated C2 traffic, and ensure endpoint protection solutions incorporate the 17 VirusTotal detections. Continuous re‑evaluation is advised as further payload samples become available.