meta-expantra[.]pages[.]dev

Analysis of the domain meta-expantra.pages.dev indicates a credential phishing operation hosted on Cloudflare Pages infrastructure. The domain was registered on February 21, 2026, and resolves to the IP address 188.114.97.3, associated with Cloudflare, Inc. (AS13335) in the United States. At the time of assessment, the domain returned an HTTP 403 status, with a page title explicitly labeled 'Suspected phishing site | Cloudflare,' suggesting detection by the hosting provider or an automated security mechanism. Fifteen of ninety-five security vendors on VirusTotal flagged the domain as malicious, corroborating its classification as a phishing threat. Google Safe Browsing further designates it as engaging in social engineering, aligning with the credential phishing categorization.

The domain appears on a single security blocklist and is actively blocked by PhishDestroy. Gridinsoft assigns a trust score of 0/100, reinforcing its high-risk status. Technical indicators reveal the use of Cloudflare nameservers (melinda.ns.cloudflare.com and mike.ns.cloudflare.com), HSTS enforcement, and HTTP/3 protocol support. The SSL certificate is issued by Google Trust Services (WE1), a common configuration for Cloudflare-hosted domains.

Despite these security features, the domain's infrastructure was leveraged for malicious purposes, as evidenced by its detection history and current offline status. Defenders should treat this domain as a confirmed phishing threat, particularly for credential harvesting. Blocking at the DNS or network level is recommended, along with monitoring for related domains using the same Cloudflare Pages naming convention or IP range. The exact content of the phishing page remains unanalyzed, but the available indicators confirm its malicious intent.