meta-holdings[.]pages[.]dev

Analysis indicates that the domain meta-holdings.pages.dev was registered on February 21 2026 through Cloudflare, Inc. The domain resolves to the Cloudflare edge address 172.66.44.85, which is associated with ASN 13335 in the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 label, confirming use of a legitimate certificate authority. An HTTP request returns a 403 status code together with the page title “Suspected phishing site | Cloudflare”, which is a generic landing page shown by Cloudflare when a site is taken down for abuse. The site is currently offline, limiting any dynamic content analysis. Reputable threat‑intelligence sources have flagged the domain as a credential‑phishing operation.

Sixteen of ninety‑three VirusTotal scanners raise a detection, and the site appears on the PhishDestroy blocklist as well as a single additional security blocklist. Google Safe Browsing categorises the URL as social‑engineering, and both Scamadviser (score 1/100) and Gridinsoft (score 0/100) assign extremely low trust ratings, reinforcing the malicious assessment. Detected infrastructure components include HSTS, Cloudflare services, and HTTP/3 support, reflecting a modern hosting configuration typical of abuse platforms. Because the only concrete evidence is the blocklist presence, the VirusTotal detection count, the Google Safe Browsing flag, and the Cloudflare takedown page, the precise phishing payload or targeted brand cannot be confirmed at this time.

Defenders should therefore treat the domain as high‑risk. Immediate mitigation steps include adding the hostname and its resolving IP address to network‑level deny lists, updating DNS‑filtering feeds that reference PhishDestroy, and monitoring for any re‑registration or re‑activation. Continuous observation of Cloudflare edge IP ranges for similar patterns is advised, as the underlying infrastructure is shared with many legitimate services.