meta-cobalt[.]pages[.]dev

This domain, meta-cobalt.pages.dev, is identified as a credential theft operation designed to harvest user login credentials through deceptive login portals. Analysis indicates the infrastructure mimics trusted platforms to trick victims into entering usernames, passwords, and multifactor authentication codes, which are then exfiltrated to attacker-controlled servers. The threat extends to potential follow-on attacks, including account takeovers, financial fraud, or lateral movement within compromised networks. Infrastructure analysis reveals the domain was registered on September 26, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.47.176, hosted on AS13335. Security vendors on VirusTotal flagged the domain with 19/95 detections, while two independent blocklists, including PhishDestroy and PhishingDB, have listed it as malicious. The SSL certificate, issued by Cloudflare TLS Issuing ECC CA 3, aligns with the registrar’s infrastructure but does not mitigate the domain’s fraudulent intent. Google Safe Browsing further classifies the site as phishing, corroborating the malicious classification. Users who visited meta-cobalt.pages.dev or entered credentials on the site should immediately revoke any active sessions on the impersonated service. Reset passwords using a secure device and enable multifactor authentication if not already active. Monitor accounts for unauthorized transactions or configuration changes, and review connected applications for suspicious permissions. If financial or sensitive data was exposed, consider placing fraud alerts with relevant institutions. Network administrators should block the domain and IP address 172.66.47.176 at the perimeter to prevent further access.