meta-cradle-eb8[.]pages[.]dev

This domain, meta-cradle-eb8.pages.dev, is identified as a high-risk phishing infrastructure targeting users through a suspected crypto drainer scheme. Analysis of the page content and historical indicators suggests an attempt to impersonate Meta (formerly Facebook) services, likely to harvest credentials or execute unauthorized cryptocurrency transactions. No explicit brand logos were recovered from the offline snapshot, but the naming convention and hosting pattern align with known Meta-themed phishing campaigns observed in late 2024 and early 2025. The domain exhibits characteristics of a drainer kit, including Cloudflare Workers-based redirection and obfuscated JavaScript payloads designed to interact with cryptocurrency wallets. Infrastructure analysis reveals the following technical indicators: the domain was registered through Cloudflare, Inc. on October 8, 2025, and resolves to the IP address 188.114.96.3, associated with AS13335 (Cloudflare, Inc.). Google Safe Browsing flags this domain as phishing, and it is currently detected by 17 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services (WE1), a common attribute in ephemeral phishing domains leveraging Cloudflare’s free tier. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and was assigned the page title 'Suspected phishing site | Cloudflare' upon takedown. As of the latest verification, meta-cradle-eb8.pages.dev has been taken offline, likely due to enforcement actions by the hosting provider or security teams. However, residual risk persists due to the domain’s recent creation and the transient nature of Cloudflare-hosted phishing infrastructure. Organizations and users are advised to block the domain and its resolving IP at the network level, monitor for related subdomains or newly registered lookalike domains, and implement multi-factor authentication for cryptocurrency wallets. Historical indicators suggest this campaign may resurface under a different subdomain or registrar, necessitating continuous monitoring of AS13335-hosted assets for similar patterns.