met-io-masks-auth[.]pages[.]dev

Analysis of the domain met-io-masks-auth.pages.dev indicates it was actively involved in credential phishing operations prior to being taken offline. The domain was registered on February 21, 2026, through Cloudflare, Inc., and resolved to the IP address 172.66.44.140, hosted on Cloudflare's infrastructure (AS13335) in the United States. Nameservers associated with the domain were jaziel.ns.cloudflare.com and cass.ns.cloudflare.com, consistent with Cloudflare's hosting services. The SSL certificate was issued by Google Trust Services (WE1), and the site enforced HSTS and HTTP/3 protocols.

At the time of assessment, the domain returned an HTTP 403 status, and its page title was explicitly labeled 'Suspected phishing site | Cloudflare,' suggesting automated or manual detection by the hosting provider. The domain appears on one security blocklist, and independent trust scores from Scamadviser and Gridinsoft both rated it at 1/100 and 0/100, respectively, indicating high confidence in its malicious classification. PhishDestroy has also flagged this domain for blocking. VirusTotal detections show 13 of 93 security vendors marked it as malicious, though the absence of additional context limits further interpretation of these results.

No specific brand or service was identified in the available data beyond the 'credential phishing' classification. The exact content or targeting methodology of the phishing page remains unconfirmed, as the site is no longer accessible. Defenders should treat this domain as confirmed malicious infrastructure and ensure it is blocked at the network and endpoint levels. Historical logs should be reviewed for connections to 172.66.44.140 or the domain itself, particularly for credential submission attempts or related user interactions.