meta-file[.]pages[.]dev

Analysis of meta-file.pages.dev, observed as offline as of July 23 2026, indicates that the domain was created on September 24 2025 and is hosted behind Cloudflare’s network (AS13335, US). DNS resolves to 188.114.97.3 and the authoritative nameservers are kyrie.ns.cloudflare.com and treasure.ns.cloudflare.com. The site presented the page title "Suspected phishing site | Cloudflare" and returned HTTP 403, suggesting that Cloudflare has blocked access. The TLS certificate was issued by SSL Corporation through the Cloudflare TLS Issuing ECC CA 3 chain, confirming the use of Cloudflare’s edge certificate infrastructure. Security‑vendor scans on VirusTotal recorded 18 detections out of 95 engines, and Google Safe Browsing classified the URL as social‑engineering.

The domain appears on a single public blocklist and is listed by PhishDestroy as malicious. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. Detected technologies include HSTS, HTTP/3, and the Cloudflare CDN. The recorded scam type is credential phishing, indicating attempts to harvest login credentials.

Because the site is already taken offline, immediate mitigation focuses on ensuring that any cached or archived copies are blocked in internal filters, updating URL blocklists, and monitoring for re‑registration or reuse of the same name or infrastructure. Uncertainty remains regarding the specific victim targeting and any payloads that may have been delivered before takedown, as no page content beyond the title has been disclosed. Defenders should continue to watch the hosting IP 188.114.97.3 and associated Cloudflare accounts for related activity, and enforce strict outbound filtering for domains flagged by Google Safe Browsing or VirusTotal. The combination of multiple vendor detections, a zero trust score, and active blocklist listings provides strong confidence that meta‑file.pages.dev was employed for credential‑phishing campaigns.