meta-castle-c4d[.]pages[.]dev

The domain meta-castle-c4d.pages.dev has been confirmed as a credential theft operation designed to harvest financial account logins through deceptive login portals. Analysis indicates the site was actively impersonating banking interfaces to capture usernames, passwords, and multi-factor authentication codes before being taken offline. The infrastructure shows clear indicators of malicious intent, with no legitimate business purpose or historical context. Infrastructure analysis reveals the domain was registered on September 23, 2025, through Cloudflare, Inc. and resolved to IP address 188.114.96.3, located within AS13335 (Cloudflare's network). Security vendors flagged this domain with 18 detections out of 95 on VirusTotal, while two major blocklists (PhishDestroy and PhishingDB) had already listed it prior to takedown. The SSL certificate was issued by Cloudflare TLS Issuing ECC CA 3, a common pattern observed in ephemeral phishing campaigns leveraging free hosting services. Google Safe Browsing classified the domain as phishing, and the page title explicitly stated 'Suspected phishing site,' suggesting automated detection by the hosting provider. Current status shows the domain as offline, though residual risk remains due to the transient nature of such operations. Organizations should treat any prior interaction with this domain as a potential compromise of financial credentials. Immediate actions include resetting passwords for any accounts accessed through this domain, enabling multi-factor authentication where not already active, and reviewing transaction logs for unauthorized activity. Network administrators should block the IP address 188.114.96.3 at perimeter defenses and monitor for similar Cloudflare-hosted domains with recent creation dates, particularly those using the pages.dev subdomain structure. End users should be educated on recognizing credential theft tactics, including urgent login prompts and mismatched URLs in financial contexts.