meteoraclaim[.]pages[.]dev

The domain meteoraclaim.pages.dev is currently active and classified as a high‑risk brand‑impersonation site targeting Cloudflare. Registration occurred on October 17 2025 through Cloudflare, Inc., and the domain resolves to IP 172.66.47.19, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. The site presents a TLS certificate issued by Google Trust Services under the WE1 profile, and HTTP traffic is served over HSTS and HTTP/3. Accessing the URL returns an HTTP 500 response with the page title “Worker threw exception | meteoraclaim.pages.dev | Cloudflare.” The domain appears on one public blocklist and is specifically blocked by PhishDestroy. VirusTotal analysis shows that 4 of 93 scanned security vendors flagged the domain, confirming malicious intent. The listed scam type is a crypto scam, and the domain actively impersonates the Cloudflare brand. No additional content has been observed; the precise payload or phishing workflow remains unknown pending deeper content analysis. Defenders should block DNS resolution for meteoraclaim.pages.dev, add the IP address 172.66.47.19 to network deny lists, and monitor outbound connections for HTTP/3 traffic to that host. Organizations using Cloudflare services should educate users to verify any Cloudflare‑related communications and disregard requests originating from this domain. Continuous surveillance of the domain’s TLS fingerprint and any changes in the underlying worker script is advised to detect potential escalation.