web-archai[.]pages[.]dev

PhishDestroy identifies web-archai.pages.dev as a recently activated domain flagged for hosting a generic phishing drainer kit. The page is registered under Cloudflare’s infrastructure and resolves to IP 188.114.97.3 via a Google Trust Services SSL certificate. At present, this domain remains under investigation with zero VirusTotal detections recorded, indicating unflagged malicious content awaiting broader recognition.

Technical indicators confirm minimal defensive coverage: VirusTotal reports 0/95 detections, Cloudflare, Inc. serves as the registrar, and the IP address points to a known Cloudflare node. The domain leverages Google Trust Services for SSL issuance and has yet to be included in major blocklists. These attributes suggest a newly deployed campaign relying on trusted hosting and encryption to evade detection.

As of this assessment, web-archai.pages.dev remains active and unblocked by major security vendors. No coordinated takedown or blocklisting response has been observed, maintaining exposure risk for users. While the current threat is classified as generic and low-coverage, users are strongly advised to avoid interaction and report the domain. Remaining risk is moderate due to ongoing investigation and potential escalation into broader phishing campaigns.