paygeno[.]com

paygeno.com was observed on 25 July 2026 as a generic phishing site offering “Virement Gratuit”. The domain was registered through NameCheap on 22 February 2026 and resolves to 188.114.96.3, an address belonging to Cloudflare (AS13335) located in the United States. The site is protected by Cloudflare, uses HTTP/3 and includes Google Analytics scripts, indicating typical use of third‑party services for traffic measurement. The SSL certificate presented is issued by Google Trust Services under the WE1 name, which is consistent with Cloudflare’s default TLS provisioning.

An HTTP 403 response was returned when the page was accessed, and the site has since been taken offline. VirusTotal reports that 2 of 95 scanned security vendors flagged the domain, and the domain appears on a single blocklist (PhishDestroy). Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. Nameservers are katja.ns.cloudflare.com and melnicoff.ns.cloudflare.com, further confirming Cloudflare hosting.

Evidence does not indicate any additional infrastructure such as command‑and‑control servers, malware payloads, or compromised accounts. The limited detection surface suggests the campaign may have been short‑lived or quickly mitigated. Defenders should add the IP address 188.114.96.3 and the domain name to their blocklists, monitor for any future re‑use of the same registrar or nameserver pattern, and enforce URL filtering for the page title “PayGeno - Virement Gratuit”. Continuous observation of Cloudflare‑hosted domains linked to the same nameservers is advised, as they may be reused for similar phishing operations.