meta-clinic[.]pages[.]dev

meta-clinic.pages.dev was registered on February 21 2026 through Cloudflare, Inc. The domain resolves to 172.66.46.249, an IP owned by AS13335 Cloudflare, Inc. in the United States. DNS is served by joel.ns.cloudflare.com and evelyn.ns.cloudflare.com. Access attempts return HTTP 403 and the front‑end page title is “Suspected phishing site | Cloudflare”, indicating that Cloudflare has taken down the site as a suspected phishing host. The SSL certificate presented is issued by Google Trust Services under the WE1 root, confirming a valid TLS chain but offering no indication of malicious intent. Reputation services assign extremely low scores: Scamadviser 1/100 and Gridinsoft 0/100.

The domain appears on a single security blocklist and is listed as blocked by PhishDestroy. Google Safe Browsing classifies the site as social‑engineering. VirusTotal analysis shows 15 of 93 scanners flag the domain, corroborating the malicious assessment. Detected technologies include HSTS, Cloudflare CDN, and HTTP/3, which are typical for fast‑response mitigation services. The current status is offline, suggesting the hosting provider has removed the content, but the infrastructure remains observable.

Uncertainty remains about the specific brand or credential set targeted, as the page title and supplied intelligence do not disclose a victim brand. Defenders should continue to block the domain at network perimeter, update URL filtering lists, and monitor the IP address for any future reuse. Incident response teams should treat any login attempts to services that may have used similar credential‑phishing lures as compromised until user verification. Continuous re‑scanning of the domain and its IP is advised to capture any re‑activation attempts.