meta-nexus-16b[.]pages[.]dev

Analysis of meta-nexus-16b.pages.dev indicates a credential phishing domain hosted on Cloudflare infrastructure. The domain was registered on February 21, 2026, and is currently offline, returning an HTTP 403 status. Infrastructure analysis reveals it resolves to 188.114.96.3 (AS13335, Cloudflare, Inc., US) and uses Cloudflare nameservers (mallory.ns.cloudflare.com, finley.ns.cloudflare.com). The SSL certificate is issued by Google Trust Services (WE1), and detected technologies include HSTS and HTTP/3.

Security vendor assessments show mixed but concerning results: 16 of 93 vendors on VirusTotal flagged the domain as malicious. Scamadviser and Gridinsoft assigned trust scores of 1/100 and 0/100, respectively, classifying it as a credential phishing threat. The domain appears on one security blocklist (PhishDestroy), and Cloudflare's own page title labels it as a 'Suspected phishing site.' While the exact content of the phishing page is not yet analyzed, the combination of low trust scores, vendor detections, and blocklist inclusion strongly suggests malicious intent.

Defenders should treat this domain as compromised and block it at the network level. Given its offline status, monitoring for reactivation or related domains using the same Cloudflare Pages subdomain pattern (e.g., *-16b.pages.dev) is recommended. No evidence links this domain to a specific brand or phishing kit beyond the credential phishing classification.