meta-helon-dryva-kino[.]pages[.]dev

Analysis of the domain meta-helon-dryva-kino.pages.dev indicates it is a confirmed credential phishing site, currently offline as of July 24, 2026. The domain was registered through Cloudflare, Inc. on February 21, 2026, and resolves to the IP address 172.66.47.182, associated with Cloudflare's autonomous system (AS13335) in the United States. The SSL certificate is issued by Google Trust Services, specifically the WE1 intermediate, and the domain employs security technologies such as HSTS and HTTP/3, alongside Cloudflare's infrastructure. The domain is flagged by 14 of 93 security vendors on VirusTotal, and it appears on at least one security blocklist, specifically PhishDestroy.

Scamadviser and Gridinsoft assign trust scores of 1/100 and 0/100, respectively, further corroborating its malicious classification. The HTTP status returned is 403 (Forbidden), and the page title displayed is 'Suspected phishing site | Cloudflare,' which aligns with its current offline status. Nameservers for the domain are nikon.ns.cloudflare.com and stephane.ns.cloudflare.com, consistent with Cloudflare's hosting infrastructure. While the exact content or targeted brand of the phishing site is not specified in available intelligence, the classification as a credential phishing operation is supported by multiple detection vendors and blocklists.

Defenders should treat this domain as malicious and maintain blocklist entries to prevent user exposure. Given its offline status, further analysis of the site's payload or infrastructure may be limited, but historical DNS and WHOIS records should be preserved for investigative purposes. No evidence of a specific phishing kit or targeted brand is present in the available data.