meta-syren-tyrox[.]pages[.]dev

On July 24, 2026, investigators observed the domain meta-syren-tyrox.pages.dev actively hosting a credential-phishing front. The site was registered through Cloudflare, Inc. on February 21, 2026 and is served entirely via Cloudflare’s edge network (nameservers galilea.ns.cloudflare.com and joel.ns.cloudflare.com). DNS resolution points to IP address 172.66.44.157, which belongs to AS13335 Cloudflare, Inc. located in the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 label, confirming that HTTPS connections are terminated at Cloudflare’s edge. HTTP headers indicate the presence of HSTS and the site negotiates HTTP/3, confirming modern protocol usage.

An HTTP request to the root URL returns a 403 status code and the page title is “Suspected phishing site | Cloudflare”, a generic block page issued by the provider. Multiple reconnaissance services have flagged the domain. VirusTotal’s latest scan recorded 16 detections out of 93 security vendors, and Gridinsoft assigned a trust score of 0 / 100, indicating a high likelihood of malicious intent. The domain appears on one public blocklist and has been explicitly blocked by the PhishDestroy threat‑intelligence feed. The overall risk rating assigned by internal assessment is elevated, and the current operational status is offline, suggesting that the phishing campaign may have been taken down or is temporarily dormant.

At present, no specific brand or service is identified as the impersonated target because the page content has not been publicly disclosed beyond the generic Cloudflare block page. Consequently, the exact phishing lure (e.g., login portal, credential harvesting form) remains unknown. Defenders should continue to block the domain at network perimeters, add the IP address 172.66.44.157 to deny‑list rules where appropriate, and monitor for any re‑appearance of the sub‑domain pattern on Cloudflare infrastructure.