meta-tide-1nc[.]pages[.]dev

Analysis of meta-tide-1nc.pages.dev indicates a credential‑phishing infrastructure that was taken offline as of the report date. The domain was registered on February 21 2026 through Cloudflare, Inc. and is hosted on Cloudflare’s network (AS13335) with the IP address 172.66.44.157 located in the United States. DNS resolution uses the Cloudflare‑provided nameservers yevgen.ns.cloudflare.com and dina.ns.cloudflare.com. The site served over HTTPS with a certificate issued by Google Trust Services (WE1) and employed HSTS and HTTP/3, consistent with typical Cloudflare‑enabled sites. HTTP requests returned a 403 status code and the page title presented by the server is “Suspected phishing site | Cloudflare”, suggesting the content was blocked by Cloudflare’s abuse mechanisms.

Reputation signals are uniformly negative. The domain appears on a single security blocklist and is specifically listed by PhishDestroy as a malicious entry. VirusTotal recorded 12 positive detections out of 95 scanned vendors, and Google Safe Browsing flagged the URL for social‑engineering. Independent trust‑rating services assign extremely low scores (Scamadviser 1/100, Gridinsoft 0/100). No additional intelligence about the targeted brand or the payload delivered by the site is available beyond the generic credential‑phishing classification.

Uncertainty remains regarding the exact phishing campaign vector, such as the lure used or the credential collection endpoint, because the site content has not been captured. Defenders should treat the domain as high‑risk and enforce blocking at the network perimeter. Immediate actions include adding the domain and its associated IP address to web‑filter and firewall deny lists, updating intrusion‑detection signatures to reflect the observed TLS fingerprint, and monitoring for any related subdomains that resolve to the same Cloudflare IP range.