pagartocf[.]site

Analysis of pagartocf.site indicates that the domain was registered on February 21, 2026 through Dynadot LLC and is currently offline. DNS resolution points to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The domain is served behind Cloudflare, as evidenced by the presence of Cloudflare‑provided nameservers hazel.ns.cloudflare.com and rob.ns.cloudflare.com, and the detection of Cloudflare and HTTP/3 among the active technologies. The page title returned by the server, "FlashUSDT | Flash USDT in Seconds | Buy Flash USDT in India," suggests an attempt to lure victims with a cryptocurrency‑related offering, although the HTTP response code is 404, indicating the expected content is not present at the time of testing.

The SSL certificate is issued by Google Trust Services under the WE1 identifier, confirming the use of a legitimate certificate authority for encryption. VirusTotal scans show that three of ninety‑five security vendors flagged the domain, providing modest corroboration of malicious intent. The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy service. Independent trust scoring from Gridinsoft assigns a score of 0 out of 100, reflecting a high likelihood of abuse.

While the observed indicators confirm the domain’s association with phishing‑related activity, the exact payload, credential‑harvesting mechanisms, and any downstream infrastructure remain unknown due to the offline status and the 404 response. Defenders should continue to block the domain at network perimeter devices, update URL filtering and threat‑intelligence feeds with the observed indicators, and monitor the associated IP address for any future re‑activation. Additional investigation may be warranted if the domain becomes reachable again, at which point content analysis and request capture would be necessary to fully characterize the threat vector.