meta-support-subregistry[.]pages[.]dev

The domain meta-support-subregistry.pages.dev was registered on February 21, 2026 and is hosted behind Cloudflare’s network (AS13335). DNS resolution points to 172.66.44.60, an IP address assigned to Cloudflare in the United States. The site employed HSTS, HTTP/3 and presented a Google Trust Services / WE1 SSL certificate, indicating a properly signed TLS chain despite the malicious intent. HTTP requests returned a 403 status code, and the page title returned by the server is “Suspected phishing site | Cloudflare”, which matches the content reported by the hosting provider when the site was taken offline.

The domain is associated with a tech‑support scam, as indicated by the listed scam type, and carries an elevated risk rating. Independent scoring from Gridinsoft assigned a trust score of 0 out of 100, reflecting a high confidence in malicious behavior. The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy remediation service. VirusTotal analysis shows that 21 of 93 scanned security vendors flagged the domain as malicious, providing additional corroboration of its threat profile.

Current investigations confirm that the site is no longer reachable, consistent with the “offline” status in the intelligence feed. However, the underlying infrastructure—namely the Cloudflare‑provided IP address and the associated nameservers (anderson.ns.cloudflare.com, ulla.ns.cloudflare.com)—remains reusable for future campaigns, and the SSL certificate continues to be valid for the domain. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑registration or reuse of the same IP range, and consider adding the IP address to threat‑intel feeds. Because the site is already offline, active takedown is unnecessary, but continued observation is advised to detect potential re‑deployment of the same hosting assets.