meta-marnil[.]pages[.]dev

Analysis of meta-marnil.pages.dev indicates a high‑risk credential phishing infrastructure that has been taken offline as of the report date, July 23, 2026. The domain was created on February 21, 2026 and is registered through Cloudflare, Inc., using the authoritative nameservers desi.ns.cloudflare.com and emerson.ns.cloudflare.com. DNS resolution points to the IPv6 address 2606:4700:310c::ac42:2f36, which belongs to AS13335 Cloudflare, Inc. in the United States. The site served an HTTP 403 response and presented the page title "Suspected phishing site | Cloudflare" under a TLS certificate issued by Google Trust Services (WE1), confirming the use of HSTS, Cloudflare front‑end services, and HTTP/3.

Google Safe Browsing classifies the URL as social engineering, and 16 of 93 VirusTotal scanners have flagged the domain as malicious. Independent reputation services assign extremely low trust scores—Gridinsoft rates it 0/100 and Scamadviser 1/100—reinforcing the phishing assessment. The domain appears on one security blocklist and has been actively blocked by the PhishDestroy mitigation service.

While the hosting infrastructure and certificate chain are well documented, the specific phishing campaign payload, targeted brand, or victim population remain undisclosed in the available data. Defenders should immediately add meta-marnil.pages.dev to deny‑list rules, enforce outbound DNS filtering for the associated IPv6 address, and monitor for any resurgence of the domain or related subdomains under the same Cloudflare account. Continuous re‑scanning with multi‑engine services is advised to capture any future changes in the threat posture.