meta-madrix[.]pages[.]dev

The domain meta-madrix.pages.dev is flagged as a credential phishing site. It was registered through Cloudflare, Inc. on February 21, 2026 and is currently taken offline, returning an HTTP 403 response that indicates a Cloudflare block page. Infrastructure analysis shows the domain resolves to IP 172.66.46.208, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. The authoritative nameservers are desi.ns.cloudflare.com and emerson.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service.

The TLS certificate is issued by Google Trust Services under the WE1 certificate authority, providing a valid HTTPS endpoint but offering no assurance of legitimacy. Reputation services paint a dire picture: Scamadviser assigns a trust score of 1 out of 100, Gridinsoft scores 0 out of 100, and Google Safe Browsing flags the domain for social engineering. VirusTotal analysis shows that 14 of 93 security vendors have marked the domain as malicious, and the domain appears on a single security blocklist while being explicitly blocked by PhishDestroy. The page title returned by the server reads “Suspected phishing site | Cloudflare,” which aligns with the credential‑phishing classification.

While the exact phishing payload or targeted brand is not disclosed, the convergence of cloud‑based registration, low reputation scores, multiple vendor detections, and Safe Browsing alerts provides strong evidence of malicious intent. Defenders should immediately block the domain and its associated IP address, add the nameservers to watchlists, and incorporate the observed indicators—such as the specific TLS issuer and the 403 response—into intrusion‑detection signatures. Continuous monitoring of Cloudflare‑hosted IP ranges for similar patterns is advised, as is periodic re‑evaluation should the site become active again.