en-phanttom[.]pages[.]dev

The domain en-phanttom.pages.dev was registered through Cloudflare on 21 February 2026 and is presently taken offline. It resolves to the Cloudflare edge address 188.114.97.3 in the United States (ASN 13335). The site presents the Cloudflare‑generated page title “Suspected phishing site | Cloudflare” and returns HTTP 403. HTTPS is enforced with HSTS and the connection uses HTTP/3; the presented certificate is issued by Google Trust Services under the “WE1” profile. Security‑vendor analysis shows 13 of 95 VirusTotal scanners flag the domain as malicious, and Google Safe Browsing classifies it as a social‑engineering threat. PhishDestroy has already blocked the host, and the domain appears on a single external blocklist.

Reputation services assign extremely low scores: Scamadviser 1/100 and Gridinsoft 0/100. The nameservers listed are mallory.ns.cloudflare.com and jimmy.ns.cloudflare.com, both Cloudflare‑controlled. The threat is identified as a brand‑impersonation campaign targeting the Phantom brand. No further technical artifacts such as payloads, command‑and‑control infrastructure, or credential‑harvesting forms have been disclosed, so the exact malicious functionality remains unknown. The HTTP response code 403 indicates that the server is intentionally denying access, consistent with Cloudflare’s takedown page rather than serving malicious content directly. The presence of HSTS and HTTP/3 suggests the infrastructure is configured for modern TLS, which may be leveraged to lend legitimacy to future phishing pages hosted on the same IP range.

Because the domain is hosted on Cloudflare’s shared infrastructure, any future re‑use of the same IP could affect unrelated customers, underscoring the need for network‑level isolation. Defenders should add 188.114.97.3 to egress and inbound filtering rules, monitor DNS queries for en‑phanttom.pages.dev and its Cloudflare nameservers, and enforce blocklisting of the domain in web‑proxy and email‑gateway solutions.