meteora-pool-creator[.]pages[.]dev

Analysis of meteora-pool-creator.pages.dev confirms active brand impersonation targeting Cloudflare, classified as an investment scam. The domain, registered on February 21, 2026, through Cloudflare, Inc., remains operational with a 200 HTTP status and resolves to 188.114.97.3 (AS13335, US). Nameservers point to Cloudflare infrastructure (diva.ns.cloudflare.com, jeremy.ns.cloudflare.com), and the SSL certificate is issued by Google Trust Services (WE1). Technologies detected include HSTS, Cloudflare services, and HTTP/3, aligning with legitimate Cloudflare-hosted pages but lacking verification of content authenticity.

Google Safe Browsing flags the domain for social engineering, and the page title explicitly states 'Suspected phishing site | Cloudflare,' reinforcing the impersonation angle. Gridinsoft assigns a trust score of 0/100, and the domain appears on at least one security blocklist (PhishDestroy). VirusTotal records 11 detections from 93 vendors, though the specific nature of these flags remains unconfirmed. The scam type is categorized as an investment scam, though no further details about the operational mechanics or targeted victims are available at this time.

Defenders should prioritize blocking this domain at the DNS or network level, particularly in environments where Cloudflare-related services are used. Monitoring for related subdomains or IP associations (188.114.97.3) may help identify additional malicious infrastructure. Given the domain's active status and confirmed impersonation of a trusted brand, user education regarding Cloudflare-themed investment scams is recommended. Further analysis of the site's content is required to determine the full scope of the threat, including any credential harvesting or financial fraud components.