meta-puryn[.]pages[.]dev

The domain meta-puryn.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. It resolves to the IP address 172.66.47.121, which belongs to AS13335 Cloudflare, Inc., located in the United States. The authoritative nameservers are adel.ns.cloudflare.com and ken.ns.cloudflare.com, indicating that the domain is hosted on Cloudflare’s edge network. The site presented a HTTP 403 response and the page title returned by the server is “Suspected phishing site | Cloudflare”, a default block page used by Cloudflare when malicious content is detected. Multiple reconnaissance services have assigned extremely low trust scores: Scamadviser rates the domain 1 out of 100, and Gridinsoft gives a score of 0 out of 100. Google Safe Browsing has flagged the domain for social engineering, and the site appears on at least one public security blocklist, currently listed by PhishDestroy.

VirusTotal analysis shows that 15 of 93 scanning engines flagged the domain, reinforcing the suspicion of malicious intent. The SSL certificate presented is issued by Google Trust Services under the WE1 identifier, which is consistent with Cloudflare‑provided TLS termination. The observed technologies include HTTP/3, HSTS enforcement, and Cloudflare’s security stack, all of which are typical for domains that have been redirected to a protective block page. The classification supplied by the intelligence feed identifies the activity as credential phishing, matching the “Suspected phishing site” page title and the social‑engineering flag from Google Safe Browsing.

Uncertainty remains regarding the specific credential collection vector because the site content was not captured before it was taken offline; the only visible artifact is the Cloudflare block page. No additional infrastructure such as command‑and‑control servers, malware drop points, or associated domains have been discovered in the available data. Defenders should immediately add meta-puryn.pages.