meta-journo[.]pages[.]dev

Analysis of meta-journo.pages.dev shows a high‑risk credential‑phishing infrastructure that has been taken offline as of the report date, July 24, 2026. The domain was created on September 24, 2025 and registered through Cloudflare, Inc., using the nameservers damien.ns.cloudflare.com and pat.ns.cloudflare.com. DNS resolution points to the IPv6 address 2606:4700:310c::ac42:2f1b, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site served an HTTPS certificate issued by Google Trust Services under the WE1 designation, indicating a valid TLS chain, but the HTTP response returned a 403 status code, suggesting access denial or content removal. Cloudflare‑specific security headers such as HSTS and support for HTTP/3 were detected, confirming the use of Cloudflare’s edge services.

Google Safe Browsing has flagged the domain for social engineering, and Gridinsoft assigned a trust score of 0 out of 100, reflecting extreme suspicion. VirusTotal analysis recorded 16 detections out of 95 scanned security vendors, reinforcing the malicious assessment. The domain appears on one known security blocklist and has been explicitly blocked by PhishDestroy. The page title presented by the server reads "Suspected phishing site | Cloudflare," which aligns with the classified scam type of credential phishing.

Given the observable indicators—recent creation, Cloudflare‑hosted infrastructure, low trust scoring, multiple vendor detections, and explicit blocklist listings—defenders should add meta-journo.pages.dev to network deny lists, enforce DNS sink‑hole rules, and monitor for any re‑registration or resurrection attempts. Continuous observation of Cloudflare‑associated IP ranges for similar patterns is also advised, as threat actors often reuse the same hosting environment for new campaigns.