meta-phonix[.]pages[.]dev

Analysis of meta-phonix.pages.dev, created on 21 February 2026, indicates that the domain is being used for credential phishing. The site is hosted behind Cloudflare’s network (AS13335, United States) and resolves to IP address 172.66.47.7. DNS records show the authoritative nameservers raquel.ns.cloudflare.com and mack.ns.cloudflare.com, confirming the use of Cloudflare’s edge services. The SSL certificate presented is issued by Google Trust Services under the WE1 designation, and the connection is protected by HSTS and HTTP/3, reflecting a modern TLS configuration despite the malicious intent.

The page title returned by the server is "Suspected phishing site | Cloudflare", and the HTTP response code is 403, indicating that the content is blocked or unavailable. Independent security services have identified the domain as high‑risk. PhishDestroy has listed it as blocked, and Google Safe Browsing flags it for social engineering. VirusTotal reports that 16 out of 93 scanning engines have flagged the domain, reinforcing the suspicion.

Reputation services assign extremely low scores: Scamadviser rates it 1/100 and Gridinsoft 0/100. The domain appears on a single security blocklist, further confirming its malicious classification. Given the observed indicators, defenders should add meta-phonix.pages.dev to URL filtering policies, block the associated IP 172.66.47.7 at the network perimeter, and monitor for any outbound connections to Cloudflare edge nodes that may be leveraged for similar campaigns. Continuous re‑evaluation is advised, as the domain status may change if the operators reactivate the site.