meta-hybrid-clg[.]pages[.]dev

The domain meta-hybrid-clg.pages.dev was registered through Cloudflare, Inc. on 21 February 2026 and resolves to the Cloudflare edge address 172.66.47.42, which is associated with ASN 13335 in the United States. The site presents a page titled “Suspected phishing site | Cloudflare” and returns HTTP 403, indicating that the content is being blocked or restricted. The SSL certificate is issued by Google Trust Services under the WE1 label, confirming use of a valid TLS chain despite the malicious intent. Reputation services rate the domain extremely low: Scamadviser assigns a trust score of 1 / 100, Gridinsoft 0 / 100, and Google Safe Browsing classifies it as social‑engineering.

The site appears on a single security blocklist and is actively blocked by PhishDestroy. VirusTotal analysis shows that 15 of 93 scanning engines flag the domain as malicious, reinforcing the high‑risk assessment. Detected technologies include HSTS, Cloudflare protection, and HTTP/3, which are typical of legitimate Cloudflare‑hosted services but do not mitigate the phishing payload. The only confirmed malicious behavior is the credential‑phishing classification supplied in the intelligence, and no further details about the targeted brand or login flow have been disclosed.

Because the domain is currently taken offline, live investigation of page content is not possible, leaving the exact lure and victim interaction unknown. Defenders should continue to block the domain at the network perimeter, update IDS/IPS signatures with the observed IP 172.66.47.42 and the host name, and monitor for any future re‑registration of the sub‑domain pattern. Threat‑intel feeds should be refreshed to capture any new detections, and users should be warned against entering credentials on any site presenting the same page title or SSL certificate. The high trust‑score deficits and multiple vendor detections justify maintaining a high‑risk posture.