zeta2[.]pages[.]dev

Analysis of zeta2.pages.dev indicates an active phishing domain hosted on Cloudflare infrastructure. The domain resolves to IP address 172.66.44.251, a Cloudflare-operated endpoint. Infrastructure review confirms registration through Cloudflare, Inc., with nameservers nataly.ns.cloudflare.com and vick.ns.cloudflare.com, consistent with Cloudflare Pages deployments. As of July 29, 2026, the domain appears on two security blocklists: PhishDestroy and ScamSniffer, signaling confirmed malicious classification by these vendors.

While 91 antivirus engines on VirusTotal currently report no detections, this absence does not confirm safety, as phishing pages often evade initial scans. The domain’s content remains unanalyzed; no brand impersonation or specific scam type has been verified. Defenders should treat this domain as high-risk due to its presence on multiple blocklists and association with phishing activity.

Network-level blocking is recommended, particularly for organizations using PhishDestroy or ScamSniffer feeds. Further investigation into the page’s payload and target brand is advised to determine the exact threat vector. No SSL or HTTP anomalies were reported in the available data, but standard precautions for Cloudflare-hosted phishing pages apply, including monitoring for credential harvesting or malware distribution.