meta-tier[.]pages[.]dev

meta-tier.pages.dev was observed as a credential‑phishing site. The domain was registered on 21 February 2026 through Cloudflare, Inc. and resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. in the United States. The site served an SSL certificate issued by Google Trust Services under the WE1 profile, indicating that TLS termination was performed by Cloudflare’s edge network. HTTP responses returned a 403 status code, and the page title presented to scanners was “Suspected phishing site | Cloudflare”, confirming that the domain is flagged by the hosting provider. Reputation metrics are uniformly negative: Gridinsoft assigned a trust score of 0 / 100, Scamadviser reported 1 / 100, and the domain appears on a single security blocklist.

VirusTotal recorded 16 detections out of 95 analyzed security vendors, and Google Safe Browsing listed the domain for social‑engineering abuse. PhishDestroy has also blocked the domain. Detected technologies include HSTS, Cloudflare services, and HTTP/3, all consistent with the underlying infrastructure. The evidence points to a short‑lived phishing campaign that is currently offline.

No additional infrastructure, such as command‑and‑control servers or secondary domains, has been disclosed. The lack of a publicly reachable page limits further content analysis, and the exact target of the credential‑phishing attempt remains unknown. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for re‑use of the associated IP address or Cloudflare nameservers (nolan.ns.cloudflare.com, bella.ns.cloudflare.com), and incorporate the observed indicators—domain name, IP, SSL issuer, and detection signatures—into threat‑intel feeds. Ongoing observation of Cloudflare‑hosted domains exhibiting similar trust‑score profiles is recommended to detect potential resurgence.