meta-jarin-melon[.]pages[.]dev

Analysis of the domain meta-jarin-melon.pages.dev indicates it was a credential phishing site hosted on Cloudflare Pages infrastructure. The domain, registered through Cloudflare, Inc. on February 21, 2026, resolved to the IP address 188.114.97.3, associated with AS13335 (Cloudflare, Inc.) in the United States. Nameservers anahi.ns.cloudflare.com and bill.ns.cloudflare.com were in use, and the SSL certificate was issued by Google Trust Services (WE1). As of July 23, 2026, the domain has been taken offline, returning an HTTP 403 status with the page title 'Suspected phishing site | Cloudflare.' This suggests Cloudflare's automated systems or manual review identified and mitigated the threat.

Detection data reveals the domain appeared on one security blocklist, and Gridinsoft assigned a trust score of 0/100. PhishDestroy blocked the domain, while Scamadviser rated it 1/100. Fifteen of 95 security vendors on VirusTotal flagged the domain as malicious, though the exact nature of the credential harvesting attempt remains unconfirmed due to the site's current unavailability. Infrastructure analysis shows the use of HTTP/3 and HSTS, which are common in legitimate and malicious sites leveraging Cloudflare's services.

The scam type was classified as credential phishing, though no specific brand or service impersonation was identified in the available metadata. Defenders should treat this domain as a confirmed phishing threat, particularly in environments where credential theft poses a high risk. Monitoring for related domains registered under Cloudflare Pages or similar hosting services may help identify follow-up campaigns. The domain's rapid detection and takedown suggest effective mitigation, but residual risk remains for users who may have interacted with the site prior to its removal.