meta-leroq-sivor-frano[.]pages[.]dev

Analysis of the domain meta-leroq-sivor-frano.pages.dev indicates it was flagged as a credential phishing site targeting users under the guise of Cloudflare infrastructure. The domain, registered through Cloudflare, Inc. on February 21, 2026, resolves to the IPv6 address 2606:4700:310c::ac42:2cd1, hosted on Cloudflare's network (AS13335) in the United States. At the time of assessment, the domain returned an HTTP 403 status with the page title 'Suspected phishing site | Cloudflare,' suggesting Cloudflare's own security mechanisms had intervened to block access. The SSL certificate, issued by Google Trust Services (WE1), confirms encrypted traffic, though this does not mitigate the domain's malicious intent.

Infrastructure analysis reveals the domain employed Cloudflare's nameservers (ophelia.ns.cloudflare.com and gabe.ns.cloudflare.com) and technologies such as HSTS and HTTP/3, likely to lend an appearance of legitimacy. However, the domain appears on at least one security blocklist, and 14 of 93 security vendors on VirusTotal flagged it as malicious. The Gridinsoft trust score of 0/100 further corroborates its classification as a high-risk phishing domain. No specific brand impersonation beyond Cloudflare itself is confirmed in the available data, though the credential phishing designation implies an attempt to harvest login credentials.

Defenders should treat this domain as compromised and prioritize blocking it at the DNS and network levels. The domain's current offline status (as of July 24, 2026) suggests takedown actions may have been successful, but monitoring for re-emergence under similar naming conventions or Cloudflare Pages subdomains is recommended. Given the use of Cloudflare's infrastructure, additional scrutiny of other *.pages.dev subdomains for phishing activity may be warranted.