frim-meta[.]pages[.]dev

The domain frim-meta.pages.dev was flagged on July 23 2026 as a credential phishing infrastructure. Registration data shows the domain was created on 21 February 2026 and was provisioned through Cloudflare, Inc., using the authoritative nameservers leia.ns.cloudflare.com and kip.ns.cloudflare.com. DNS resolution points to IP address 172.66.47.136, which belongs to AS13335 Cloudflare, Inc. in the United States. The host presents a Google Trust Services / WE1 SSL certificate and advertises HSTS and HTTP/3 support, indicating a modern TLS configuration despite its malicious intent. VirusTotal analysis recorded 16 positive detections out of 93 scanned security vendors, confirming that multiple anti‑malware engines consider the domain malicious.

The site appears on a single external blocklist and has been actively blocked by the PhishDestroy service. Independent security scoring from Gridinsoft assigned a trust score of 0 out of 100, reinforcing the negative assessment. An HTTP request to the domain returns a 403 status code, and the page title returned by Cloudflare reads “Suspected phishing site | Cloudflare”, which is consistent with a takedown page rather than the original phishing content. The available intelligence classifies the operation as credential phishing, but no specific target brand or login portal has been disclosed in the collected artefacts. Consequently, the exact phishing vector and victim profile remain uncertain.

Defenders should treat the domain and its associated IP as hostile. Recommended actions include adding frim-meta.pages.dev to DNS and proxy blocklists, denying outbound connections to 172.66.47.136 at the network perimeter, and ensuring that endpoint protection solutions are updated with the VirusTotal detection signatures. Continuous monitoring of Cloudflare‑hosted sub‑domains is advised, as the attacker may shift to new hostnames while retaining the same infrastructure.