meta-wallot-secure-en[.]pages[.]dev

The domain meta-wallot-secure-en.pages.dev was registered on 21 February 2026 via Cloudflare’s registrar service. DNS resolution points to the Cloudflare‑owned address 172.66.44.231, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. The domain is served behind Cloudflare, with HSTS and HTTP/3 enabled, and presents a TLS certificate issued by Google Trust Services under the WE1 root, indicating a valid HTTPS endpoint. The public page title returned by the server is “Suspected phishing site | Cloudflare”, and the site is classified as a credential phishing campaign. An HTTP 403 response is observed, suggesting the content has been taken offline.

The domain appears on a single security blocklist and is actively blocked by PhishDestroy. On VirusTotal, 13 of 93 scanning engines reported malicious activity, reinforcing the malicious classification. The Gridinsoft trust score is 0 out of 100, reflecting a low reputation. Nameservers are kenneth.ns.cloudflare.com and nataly.ns.cloudflare.com, both operated by Cloudflare.

No additional evidence such as payload samples, landing‑page screenshots, or target brand details is available in the current intelligence set. Defenders should treat the domain as hostile, add the hostname and associated IP address to blocklists, and monitor for any future redeployment of the same infrastructure. Continuous re‑assessment is recommended, as the domain may be re‑activated or used in conjunction with other phishing kits. Logging of DNS queries and TLS handshakes for this host can aid in early detection of repeat activity.