The scanner was blocked by a WAF (Cloudflare) while attempting to load the URL, with a blocker page shown in the screenshot. This is a strong signal of anti-scanning measures and potential attempt to evade automated detection. Domain intelligence indicates a recently registered domain under noctua.paris with legitimate SSL but no firm evidence of credential harvesting on the static page. The observed POST analytics endpoint and multiple third-party script loads suggest standard telemetry and media site functionality rather than a clear phishing construct at this moment. Given the WAF block and domain signals, treat as suspicious hosting with potential abuse risk, but no conclusive credential phishing identified from the available non-blocked data.