meta-linox-syren[.]pages[.]dev

Analysis of meta-linox-syren.pages.dev indicates this domain was actively involved in credential phishing operations before being taken offline. The domain, registered on February 21, 2026, through Cloudflare, Inc., resolved to the IP address 188.114.96.3, hosted by Cloudflare in Canada. At the time of assessment (July 23, 2026), the domain returned an HTTP 403 status, suggesting access restrictions or takedown actions. Security vendors flagged the domain, with 15 out of 93 detection engines on VirusTotal identifying it as malicious.

The domain appears on at least one security blocklist, specifically PhishDestroy, and received trust scores of 0/100 from Gridinsoft and 1/100 from Scamadviser, reinforcing its classification as a high-risk credential phishing site. Infrastructure analysis reveals the use of Cloudflare nameservers (anahi.ns.cloudflare.com and bill.ns.cloudflare.com) and technologies including HSTS and HTTP/3, which are consistent with modern phishing campaigns leveraging CDN protections to evade detection. The page title, 'meta-linox-syren.pages.dev,' does not provide explicit brand targeting details, and no specific phishing kit or targeted organization is confirmed in the available data.

Defenders should treat this domain as a confirmed phishing threat, particularly for credential harvesting. Network-level blocking is recommended, along with monitoring for related domains or IPs associated with the same infrastructure. While the domain is currently offline, historical DNS and WHOIS records should be preserved for forensic analysis if related incidents are reported.