meta-validatorcore[.]pages[.]dev

Analysis of meta-validatorcore.pages.dev shows a newly created domain (registered 21 Feb 2026) that has been taken offline after being flagged for credential phishing. The site resolves to 172.66.46.248, an address owned by Cloudflare (AS13335) in the United States. DNS is served by everton.ns.cloudflare.com and penny.ns.cloudflare.com, confirming the use of Cloudflare’s hosting platform. The SSL certificate is issued by Google Trust Services under the WE1 designation, and the server presents HSTS, HTTP/3 and other Cloudflare‑provided security headers. Public reputation services have identified the domain as malicious.

Google Safe Browsing lists it as a social‑engineering threat, and 16 of 93 VirusTotal scanners have flagged it. The page title returned by the server is “Suspected phishing site | Cloudflare” and the HTTP response code is 403, indicating that the content was blocked by Cloudflare’s protective page. Gridinsoft assigns a trust score of 0/100, and the domain appears on at least one security blocklist, including PhishDestroy. The evidence points to a credential‑phishing campaign that likely aimed to harvest login credentials before the site was removed. No further content, target brand or phishing kit details are available because the site is offline and no visual inspection has been performed.

Consequently, the exact luring vector and victim profile remain unknown. Defenders should add meta-validatorcore.pages.dev to DNS and URL filtering policies, incorporate the domain into intrusion‑prevention signatures, and monitor Cloudflare‑assigned IP ranges for any re‑use. Continuous updates from Google Safe Browsing, VirusTotal and blocklist feeds are recommended to capture any future re‑registration attempts. Given the high risk rating and the confirmed malicious indicators, immediate blocking is advised.