papyrus-de4[.]pages[.]dev

PhishDestroy identifies papyrus-de4.pages.dev as an actively malicious domain engaged in generic phishing. The domain poses an immediate, unverified risk to end users through potential credential harvesting, data exfiltration, or malware distribution vectors. As of the latest analysis, the campaign remains under investigation with no confirmed blocklist inclusion despite its zero detection rate on VirusTotal. This domain was flagged via seed d75514 and shows the following technical indicators: it resolves to IP 188.114.97.3, is registered through Cloudflare, Inc., and holds an SSL certificate issued by Google Trust Services. The domain currently has 0 detections out of 95 engines on VirusTotal as of the investigation timestamp. It operates under Cloudflare Pages, which is frequently abused for rapid deployment and evasion of detection. No historical blocklist references or community reports were found during initial triage, indicating a likely newly activated infrastructure. To mitigate exposure to this threat, users should avoid interacting with links or attachments associated with papyrus-de4.pages.dev and report any suspicious communications immediately. Organizations are advised to update email filtering rules to include domain-based blocking for papyrus-de4.pages.dev and its resolved IP 188.114.97.3. Users who may have submitted credentials should rotate passwords immediately and enable multi-factor authentication on all related accounts. Security teams should monitor for inbound traffic to 188.114.97.3 and inspect DNS logs for resolution attempts involving papyrus-de4.pages.dev.