arion-labs[.]pages[.]dev

Analysis of the domain arion-labs.pages.dev, registered through Cloudflare, Inc. on February 21, 2026, indicates it was actively flagged as a credential phishing site prior to being taken offline. The domain resolved to the IP address 188.114.97.3, part of AS13335 (Cloudflare, Inc.), and was hosted within Cloudflare's infrastructure, utilizing nameservers jade.ns.cloudflare.com and ryan.ns.cloudflare.com. The SSL certificate was issued by Google Trust Services (WE1), and the site employed HTTP/3 and HSTS, typical of Cloudflare-hosted properties. At the time of assessment, the domain returned an HTTP 403 status, consistent with Cloudflare's enforcement actions against suspected phishing content, as reflected in the page title 'Suspected phishing site | Cloudflare.' Detection metrics further substantiate the malicious classification: 15 of 95 security vendors on VirusTotal flagged the domain, and it appeared on at least one security blocklist.

Trust scores from Gridinsoft and Scamadviser were uniformly low (0/100 and 1/100, respectively), reinforcing the elevated risk assessment. The domain was also blocked by PhishDestroy, a specialized anti-phishing service. While the exact brand or service being impersonated remains unconfirmed due to the absence of detailed page content analysis, the scam type is explicitly categorized as credential phishing based on available intelligence.

Defenders should treat this domain as compromised and maintain existing blocks. Network administrators are advised to monitor for residual connections to 188.114.97.3 or related Cloudflare-hosted subdomains, particularly those leveraging the pages.dev namespace. Given the domain's registration recency and rapid takedown, further investigation into the registrar's abuse handling processes may be warranted to assess potential patterns of abuse within Cloudflare's platform.