metaverse-hub[.]pages[.]dev

Analysis performed on 23 July 2026 indicates that the domain metaverse-hub.pages.dev was created on 21 February 2026 and is hosted behind Cloudflare’s edge network (AS13335, IP 188.114.97.3, United States). The domain resolves to a Cloudflare‑managed IP and uses HSTS and HTTP/3, confirming modern web‑security configurations but also showing that the attacker leveraged a reputable CDN to mask origin. The SSL certificate presented is issued by Google Trust Services under the WE1 profile, a legitimate certificate authority, which further reduces superficial suspicion for casual users. Despite the legitimate certificate, multiple security services have flagged the domain. Google Safe Browsing classifies it for social engineering, and the site appears on at least one public blocklist, where PhishDestroy has already added it.

VirusTotal scans show that 19 out of 95 antivirus and URL‑reputation engines have raised detections, reinforcing a high‑risk assessment. Independent trust scoring services assign extremely low reputations: Gridinsoft reports a score of 0/100 and Scamadviser a score of 1/100. The page title returned by the server is “Suspected phishing site | Cloudflare,” a generic placeholder page presented when Cloudflare’s protection has been triggered. The HTTP response returned a 403 status, indicating that direct access is currently denied, and the current operational status is listed as offline. The listed scam type is “Brand Impersonation,” although the specific brand being spoofed is not disclosed in the available metadata.

Defenders should continue to block the domain at perimeter firewalls, DNS filters, and email gateways, and monitor for any re‑registration attempts or changes in the DNS records. Given the Cloudflare hosting, future iterations may reuse the same IP range, so rule sets should target the FQDN rather than a static IP.