wallet-meta-support--cdn[.]pages[.]dev

Analysis of the domain wallet-meta-support--cdn.pages.dev shows a high-risk brand-impersonation campaign targeting Google users. The domain was registered on 21 February 2026 through Cloudflare, Inc., and resolves to the IP address 172.66.47.166, which belongs to AS13335 Cloudflare, Inc. in the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 label, indicating an attempt to lend credibility to the site. HTTP requests receive a 403 response, and the page title returned by the server is "Suspected phishing site | Cloudflare", confirming that Cloudflare has taken down the content.

Detected technologies include HSTS, HTTP/3, and the Cloudflare edge network. The domain is listed on at least one public phishing blocklist and has been blocked by PhishDestroy. Google Safe Browsing flags the site for social engineering, and VirusTotal reports 14 of 93 scanners labeling the URL as malicious. Additional reputation data shows a Gridinsoft trust score of 0 / 100, reinforcing the malicious nature.

The nameservers zod.ns.cloudflare.com and venus.ns.cloudflare.com are standard Cloudflare defaults. Current status is offline, indicating that the hosting provider has removed the content, but the infrastructure remains usable for future campaigns. Defenders should continue to block the domain at the DNS and proxy layers, monitor for reuse of the associated IP address or Cloudflare account, and update detection rules to flag any new subdomains that share the same registrar or certificate characteristics. Incident response teams should also advise users that any unexpected requests claiming to be from Google originating from this domain are fraudulent.