meta-wirax[.]pages[.]dev

Analysis indicates that the domain meta-wirax.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. The authoritative nameservers are seamus.ns.cloudflare.com and sureena.ns.cloudflare.com, both operated by Cloudflare. DNS resolution points to the address 172.66.46.240, which belongs to ASN 13335 (Cloudflare, Inc.) and is geolocated in the United States. HTTP requests return a 403 status code and the page title reported by the server is “Suspected phishing site | Cloudflare”, suggesting that the site is being used for credential‑phishing and has been taken offline. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming the use of a valid HTTPS certificate.

Security telemetry shows that 16 of 93 VirusTotal scanners flagged the domain, and it appears on one public blocklist. The Gridinsoft trust score is 0 / 100, indicating a high likelihood of malicious intent. The site employs Cloudflare‑provided security headers including HSTS and HTTP/3. PhishDestroy has recorded the domain as blocked.

Defenders should add the domain and its IP address to network‑level deny lists, ensure that any email filtering rules that reference the domain are updated, and monitor for related sub‑domains or newly registered Cloudflare‑hosted zones that share the same nameserver pattern. Because the content of the page has not been captured, the specific brand or credential target remains unknown; further sandbox analysis of any payloads delivered from the domain would be required to clarify the phishing campaign’s objective. Continuous observation of Cloudflare‑registered domains created after February 2026 is recommended to detect similar infrastructure reuse.