meta-bulwark[.]pages[.]dev

The domain meta-bulwark.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge address 188.114.96.3, ASN 13335 located in the United States. DNS is served by meg.ns.cloudflare.com and stan.ns.cloudflare.com. The site presented the page title “Suspected phishing site | Cloudflare” and returned HTTP 403, indicating the host is actively blocking access. TLS is provided by Google Trust Services under the WE1 certificate, and the connection enforces HSTS while supporting HTTP/3, confirming the use of modern Cloudflare infrastructure.

Threat intelligence marks the domain as a credential‑phishing campaign. VirusTotal recorded 16 detections out of 93 scanning engines, reinforcing the malicious classification. Independent reputation services assign near‑zero trust: Scamadviser scores the site 1 / 100, Gridinsoft reports 0 / 100, and the domain appears on one known security blocklist. PhishDestroy has already added the host to its block list, indicating that at least one industry sinkhole is actively preventing traffic.

While the site is currently offline, the infrastructure details remain relevant for detection and mitigation. Defenders should continue to block traffic to 188.114.96.3 at the network perimeter, enforce DNS filtering for the domain and its authoritative nameservers, and monitor for any re‑registration attempts that reuse the same Cloudflare‑issued address space. Correlation with the 16 VirusTotal detections can aid in refining email‑gateway signatures, and the HTTP 403 response suggests that any future attempts to access the site will likely be met with a default denial page, which can be leveraged for safe‑list verification. Continuous observation of Cloudflare‑issued certificates and HSTS settings is recommended to catch any rapid redeployment of the phishing payload.