mnbirbmenu[.]pages[.]dev

The domain mnbirbmenu.pages.dev was registered on February 7 2026 through Cloudflare Pages and resolves to the IPv4 address 188.114.97.3. The hosting infrastructure is provided by Cloudflare, which is reflected in the use of a Cloudflare‑Pages sub‑domain and the shared IP address that is commonly allocated to many unrelated sites. The domain appears on a single public security blocklist and has been actively blocked by the PhishDestroy sinkhole, indicating that at least one defensive network has observed malicious traffic associated with it.

VirusTotal records show that the domain was submitted for analysis and scanned by 91 anti‑malware engines; none of the engines reported a detection at the time of scanning. While the absence of detections does not imply benign intent, it does demonstrate that the payload, if any, was not identified by those scanners during that snapshot. No page title, SSL certificate details, Safe Browsing verdict, or Open Threat Exchange (OTX) indicators have been published for the domain, and no brand or phishing kit attribution is currently available.

Consequently, the precise content and the intended victim lure remain unknown. Defenders should continue to block the domain at network perimeter and DNS layers, monitor outbound connections to the IP 188.114.97.3, and consider adding the domain to internal blocklists. Ongoing threat‑intel feeds should be consulted for any future attribution or detection updates, and any observed traffic should be captured for forensic analysis to determine whether credential harvesting or malware delivery is occurring.