meta-monar-zenil[.]pages[.]dev

On July 24, 2026, the domain meta-monar-zenil.pages.dev was observed to be taken offline, returning HTTP 403. The site was registered on February 21, 2026 through Cloudflare, Inc., and is served from Cloudflare’s IP 188.114.97.3 (AS13335, United States). The DNS configuration uses Cloudflare name servers damien.ns.cloudflare.com and aria.ns.cloudflare.com, and the service employs HSTS and HTTP/3, confirming the use of Cloudflare’s edge network. The presented page title, “Suspected phishing site | Cloudflare”, suggests the domain was flagged by Cloudflare’s protective mechanisms as a phishing host.

Independent scanning on VirusTotal recorded 16 detections out of 93 security vendors, indicating a consensus among multiple scanners that the domain hosts malicious content. The domain appears on one public blocklist and is specifically listed by PhishDestroy, reinforcing its classification as a phishing resource. Reputation services assign extremely low scores: Gridinsoft rates it 0/100, and Scamadviser rates it 1/100, reflecting a high likelihood of abuse. The SSL certificate is issued by Google Trust Services under the WE1 identifier, which is typical for Cloudflare‑provided TLS but does not mitigate the malicious nature of the content.

Because the site is currently offline, direct content analysis is not possible; the exact phishing lure, targeted brand, or credential‑harvesting page remains unidentified. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑activation, and correlate any observed traffic to the IP address 188.114.97.3 with other known phishing incidents. Additional investigation should include requesting full payloads from the scanners that flagged the domain to determine the specific payload or credential‑stealing technique employed.