meta-pioneer-e50[.]pages[.]dev

The domain meta-pioneer-e50.pages.dev is suspected of being a credential theft phishing site. Analysis indicates that it was designed to impersonate Cloudflare, leveraging the brand's reputation to trick users into divulging sensitive information. The page title 'Suspected phishing site | Cloudflare' further suggests that the domain was used to deceive visitors into believing it was an official Cloudflare page.

Infrastructure analysis reveals that the domain was registered through Cloudflare, Inc. and created on November 13, 2025. It resolves to the IP address 172.66.47.81, which is located in the United States and belongs to AS13335 Cloudflare, Inc. The SSL certificate is issued by Google Trust Services / WE1, adding a layer of perceived legitimacy. On VirusTotal, 15 out of 95 security vendors flag this domain as malicious, indicating a moderate level of detection. Additionally, the domain appears on two security blocklists: PhishDestroy and PhishingDB, further confirming its malicious nature. The site is currently offline, which may indicate that it has been taken down or is temporarily inactive.

If users have visited this domain, they should immediately check their account activity for any unauthorized access and change their passwords. It is also recommended to enable two-factor authentication (2FA) on all critical accounts to add an additional layer of security. Users should monitor their financial statements and credit reports for any signs of fraud. Reporting the incident to their respective security teams or IT departments is advised to ensure that appropriate measures are taken to mitigate potential risks.