mainnetnodes-en[.]pages[.]dev

Analysis of mainnetnodes-en.pages.dev indicates that the domain was registered on February 21, 2026 and is hosted on Cloudflare infrastructure (ASN13335, IP 188.114.97.3 located in the United States). The domain resolves to a Cloudflare edge node and uses the nameservers jarred.ns.cloudflare.com and gracie.ns.cloudflare.com, both owned by Cloudflare. TLS termination is provided by Google Trust Services under the WE1 certificate, and the site enforces HSTS and HTTP/3, confirming modern security headers. An HTTP request to the origin returned a 403 status code, and the page title presented by the server is "Suspected phishing site | Cloudflare," which is a standard Cloudflare block page.

The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy service. Independent assessment by Gridinsoft assigned a trust score of 0 out of 100, the lowest possible rating. The threat classification recorded is credential phishing, suggesting attempts to harvest login credentials, although the specific target brand or service is not disclosed in the available data.

Current operational status is offline, and the risk level remains under investigation. Defenders should continue to block the domain at perimeter defenses, monitor DNS queries for the associated IP and nameservers, and treat any traffic to the domain as malicious until further evidence clarifies its intent. Ongoing observation of related Cloudflare‑hosted assets is recommended to detect possible re‑use of the infrastructure for future campaigns.