meta-north-bgj[.]pages[.]dev

Analysis shows that meta-north-bgj.pages.dev was created on 21 February 2026 and is hosted behind Cloudflare’s network (IP 172.66.47.3, AS13335, United States). The domain resolves to a Cloudflare‑provided certificate issued by Google Trust Services (WE1) and enforces HSTS while supporting HTTP/3. DNS is served by Cloudflare name servers olivia.ns.cloudflare.com and micah.ns.cloudflare.com. The site returned an HTTP 403 status and the page title presented by the server is “Suspected phishing site | Cloudflare”, indicating that the content has been flagged by Cloudflare’s abuse mechanisms.

Google Safe Browsing classifies the URL as social engineering, and PhishDestroy has listed the domain as blocked. Independent reputation services assign extremely low trust scores: Gridinsoft 0/100, Scamadviser 1/100. VirusTotal reports that 15 of 95 scanning engines flag the domain, reinforcing the malicious assessment. The identified scam type is credential phishing, suggesting attempts to harvest login credentials.

The domain appears on a single external blocklist, but the combination of multiple independent detections, low trust scores, and Cloudflare’s own takedown page provides strong evidence of malicious intent. Uncertainty remains regarding the exact payload or credential‑harvesting workflow because the site is offline and no visual content has been captured. Defenders should immediately block DNS resolution for meta-north-bgj.pages.dev, add the IP address 172.66.47.3 to network‑level deny lists, and monitor outbound traffic for attempts to contact Cloudflare‑hosted endpoints that match this domain. Continuous re‑scanning of the domain on VirusTotal and other threat intel platforms is advised to capture any future re‑activations or changes in hosting infrastructure.