app-metamrks[.]pages[.]dev

Analysis indicates that the domain app-metamrks.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge address 188.114.97.3, located in the United States under ASN 13335. The site served a page titled “Suspected phishing site | Cloudflare” and responded with HTTP 403, while HSTS and HTTP/3 were observed, suggesting standard Cloudflare security features. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming a valid HTTPS endpoint. Reputation data shows the domain appears on a single security blocklist and is actively blocked by PhishDestroy.

Four out of ninety‑three VirusTotal scanners flagged the domain, and Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious classification. The scam type is identified as credential phishing, consistent with the page title and the blocklist categorization. The infrastructure footprint is limited to the Cloudflare network; no additional hosting or backend details are disclosed.

Uncertainty remains regarding the actual payload or credential collection mechanisms because the site is currently offline and no content analysis is available. Defenders should immediately block the domain at perimeter defenses, add the IP address 188.114.97.3 to deny lists where appropriate, and monitor for any future resolution changes or similar sub‑domains using the same nameservers (marvin.ns.cloudflare.com, raina.ns.cloudflare.com). Ongoing surveillance of Cloudflare‑hosted domains with low trust scores and early VirusTotal detections is recommended to catch variants that may appear before they are taken offline.