metaextnsion-hub[.]pages[.]dev

The domain metaextnsion-hub.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presents the page title “Suspected phishing site | Cloudflare” and serves an SSL certificate issued by Google Trust Services / WE1, indicating a valid HTTPS endpoint. Infrastructure analysis shows the domain employs HSTS, Cloudflare services, and HTTP/3, consistent with typical abuse of the Cloudflare network for fast‑deployment phishing sites. HTTP responses currently return a 403 status, confirming the site has been taken offline, and the domain is listed as “offline” in the threat feed.

Threat intelligence flags the domain as a credential‑phishing operation. Google Safe Browsing classifies it as social engineering, and it appears on one external security blocklist. PhishDestroy has also listed the domain as malicious. VirusTotal scans reveal that 11 of 93 security vendors have flagged the domain, providing a modest but notable detection rate. The Gridinsoft trust score of 0 / 100 further underscores the malicious reputation. The domain’s authoritative nameservers are plato.ns.cloudflare.com and magnolia.ns.cloudflare.com.

While the exact content of the phishing page is not available due to the 403 response, the combination of blocklist inclusion, Safe Browsing flag, multiple vendor detections, low trust score, and the credential‑phishing classification indicates a high‑risk threat. Defenders should immediately block the domain at DNS and network layers, add it to internal URL filtering lists, and monitor the associated IP address for any re‑activation attempts. Continuous re‑scanning of the domain is advised, as threat actors frequently resurrect or relocate phishing infrastructure under the same Cloudflare‑hosted domain prefix.