meta-upgrade-1cm[.]pages[.]dev

The domain meta-upgrade-1cm.pages.dev was provisioned on February 21, 2026 through Cloudflare, Inc. and immediately surfaced in security monitoring tools. The site presents the page title "Suspected phishing site | Cloudflare" and is classified as a credential phishing operation. Network analysis shows the domain resolves to IP 172.66.44.98, which belongs to AS13335 Cloudflare, Inc., located in the United States. The TLS certificate is issued by Google Trust Services under the WE1 identifier, indicating a valid HTTPS endpoint despite the malicious intent.

HTTP responses return a 403 status code, and the service advertises HSTS and HTTP/3 via Cloudflare infrastructure. Reputation services flag the domain severely: Gridinsoft assigns a 0 / 100 score, Scamadviser rates it 1 / 100, and Google Safe Browsing flags the URL for social‑engineering content. VirusTotal reports 16 of 93 scanning engines labeling the domain as malicious, and the domain appears on one external blocklist. PhishDestroy has already blocked the domain, and additional threat‑intel feeds list it as offline at the time of this report.

Defenders should continue to deny any connections to the IP address 172.66.44.98, enforce outbound filtering for the domain, and update local blocklists with the provided nameservers (norah.ns.cloudflare.com, dan.ns.cloudflare.com). Because the site is currently taken offline, ongoing monitoring of the host range and Cloudflare‑associated IP blocks is advised to catch any rapid redeployment. The limited public data prevents confirmation of the exact credential capture vector, so investigative teams should treat the domain as high‑risk until the infrastructure is fully dismantled.