meta-merklogi[.]pages[.]dev

Analysis of meta-merklogi.pages.dev, observed on July 24 2026, shows that the domain is currently offline and returns HTTP 403. The site was registered through Cloudflare, Inc. and uses Cloudflare‑provided nameservers (adi.ns.cloudflare.com, karl.ns.cloudflare.com, lee.ns.cloudflare.com, rosa.ns.cloud). DNS resolution points to 172.66.45.46, an address owned by AS13335 Cloudflare, Inc. in the United States. The TLS certificate is issued by Google Trust Services under the WE1 root, indicating a valid HTTPS endpoint at the time of capture. HTTP headers report HSTS and HTTP/3 support, consistent with Cloudflare edge services.

The page title returned by the server is “Suspected phishing site | Cloudflare”, matching the classification of credential phishing in the supplied intelligence. Google Safe Browsing flags the domain for social engineering, and VirusTotal records 13 positive detections out of 93 scanners, reinforcing the malicious assessment. The domain appears on a single external blocklist and is listed as blocked by PhishDestroy. Independent trust scoring from Gridinsoft assigns a score of 0 / 100, reflecting extreme risk. The domain was created on 2 September 2020, suggesting that the infrastructure may have been dormant before recent activation.

No additional payload or landing‑page content is available because the site is offline, leaving the exact phishing lure unknown. Defenders should continue to block the IP address 172.66.45.46 and the associated ASN 13335, enforce DNS‑level denial of the domain, and monitor for re‑hosting attempts on other Cloudflare‑managed zones. Email and web gateway filters should treat any future resolution of this domain as malicious, and incident response teams should check logs for prior connections to the 172.66.45.46 address. Ongoing observation of Cloudflare‑registered domains with similar naming patterns is recommended to catch potential re‑use.