metana-vault[.]pages[.]dev

Analysis of metana-vault.pages.dev, observed as an offline site on July 24, 2026, indicates a high‑confidence investment phishing operation. The domain was registered on February 21, 2026 through Cloudflare, Inc., and resolves to the Cloudflare‑owned address 172.66.44.254 (AS13335, United States). DNS resolution is served by leonard.ns.cloudflare.com and magali.ns.cloudflare.com, confirming Cloudflare as the authoritative nameserver. The site presented the page title "Suspected phishing site | Cloudflare" and responded with HTTP 403, suggesting that the content was blocked or removed prior to the investigation. SSL termination is provided by Google Trust Services under the WE1 certificate, and the server enforces HSTS and HTTP/3, consistent with modern Cloudflare deployments.

Reputation services rate the domain extremely poorly: Gridinsoft assigns a trust score of 0/100, Scamadviser a score of 1/100, and the domain appears on one known security blocklist, currently listed by PhishDestroy. VirusTotal analysis shows that 15 of 93 scanning engines flagged the domain, reinforcing the malicious assessment. The classified scam type is "Investment Scam," aligning with the observed reputation metrics.

Defenders should treat any network traffic to or from metana-vault.pages.dev as malicious. Block the domain at DNS and proxy layers, and add its IP address 172.66.44.254 to deny lists, noting that the IP is shared across many Cloudflare customers and may require contextual filtering. Monitor for any future re‑registration of the domain or similar sub‑domains under the pages.dev namespace, as threat actors often recycle infrastructure. Continuous threat‑intel feeds should be consulted for updates, and incident response teams should be prepared to investigate any user reports referencing investment‑related phishing attempts linked to this domain.