meta-runnel[.]pages[.]dev

Analysis of meta-runnel.pages.dev indicates a confirmed credential phishing operation hosted on Cloudflare Pages infrastructure. The domain, registered on February 21, 2026, resolves to 172.66.44.58 (AS13335, Cloudflare, Inc., US) and is currently offline with an HTTP 403 status. Cloudflare's own page title explicitly labels it as a 'Suspected phishing site,' and the domain appears on at least one security blocklist (PhishDestroy). Detection engines on VirusTotal flagged the domain, with 15 of 93 vendors identifying it as malicious.

Trust scores from Scamadviser (1/100) and Gridinsoft (0/100) further corroborate its fraudulent nature. Infrastructure analysis reveals the use of Cloudflare nameservers (keanu.ns.cloudflare.com, sierra.ns.cloudflare.com), HSTS enforcement, and HTTP/3 support, which are common among phishing campaigns leveraging Cloudflare's CDN to evade takedowns. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider often abused for phishing domains. While the exact brand or service being impersonated is not specified in available data, the scam type is classified as credential phishing based on intelligence sources.

Defenders should treat this domain as a confirmed threat. Block access to 172.66.44.58 and the domain at the network level, and monitor for any re-emergence under similar naming patterns or Cloudflare Pages subdomains. Given the domain's offline status, further forensic analysis may be limited, but historical DNS and WHOIS records should be preserved for potential incident response. No evidence suggests this campaign targets a specific sector or brand beyond generic credential harvesting.