sso-meta-ext-io[.]pages[.]dev

The domain sso-meta-ext-io.pages.dev was created on February 21, 2026 and is hosted on Cloudflare’s network (ASN 13335, United States). DNS resolution points to IP address 172.66.44.238 and the authoritative name servers are betty.ns.cloudflare.com and joaquin.ns.cloudflare.com. The site served an HTTP 403 response and the page title returned by the server was "Suspected phishing site | Cloudflare", indicating that the content was flagged by Cloudflare’s own protection mechanisms. The SSL certificate presented is issued by Google Trust Services under the WE1 root, confirming a valid TLS handshake but offering no indication of legitimate ownership.

Google Safe Browsing classified the domain as a social‑engineering threat, and a reputable blocklist (PhishDestroy) has already taken the domain offline. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single security blocklist. VirusTotal analysis shows that 13 of 93 scanning engines flagged the domain, reinforcing the suspicion of malicious activity.

The identified scam type is credential phishing, targeting user credentials through a deceptive login page, although the exact target brand cannot be confirmed from the available evidence. Defenders should immediately block the domain at network perimeters and DNS resolvers, monitor for any resurgence of the host on the same IP or name‑server pair, and incorporate the domain hash into threat‑intel feeds. Continuous observation of Cloudflare‑hosted infrastructure is advised, as attackers may repurpose the same CDN assets for future campaigns.