paper-6da[.]pages[.]dev

paper-6da.pages.dev is identified as a brand_impersonation infrastructure impersonating Binance, presenting a PEPE-themed page. The domain is currently active and continues to serve phishing-oriented content aimed at credential harvesting and user deception. The structure and branding mismatch indicates a high-confidence impersonation attempt targeting cryptocurrency users.

Security telemetry reports the domain is flagged by 1/95 security vendors, and it appears on 2 independent blocklists (PhishDestroy, ScamSniffer). Infrastructure analysis shows it resolves to IP 188.114.97.3 under AS13335 Cloudflare, Inc., and is registered through Cloudflare, Inc. The SSL certificate is issued by Google Trust Services (WE1). Domain creation date is September 09, 2024, indicating relatively recent provisioning consistent with short-lived phishing infrastructure.

At present the domain remains active, increasing exposure risk to users misled by impersonation of Binance branding. The observed PEPE title may be used to attract speculative traffic and obscure the fraudulent intent. Users should avoid interacting with the page, and organizations should enforce domain blocking, monitor DNS resolutions to 188.114.97.3, and deploy threat intelligence feeds to detect similar pages. Given the low but present detection ratio (1/95) and multiple blocklist confirmations, the domain should be treated as high risk and prioritized for takedown reporting and network-level filtering.