meta-hyroz-feral[.]pages[.]dev

This domain, meta-hyroz-feral.pages.dev, was flagged as a credential phishing site and taken offline by July 24, 2026. Analysis indicates it was registered on February 21, 2026, through Cloudflare, Inc., and hosted on Cloudflare infrastructure (IP 172.66.47.95, AS13335). The domain resolved to nameservers lynn.ns.cloudflare.com and margaret.ns.cloudflare.com, with an SSL certificate issued by Google Trust Services (WE1). At the time of assessment, the HTTP status returned a 403 error, and the page title displayed 'Suspected phishing site | Cloudflare,' suggesting Cloudflare's automated detection systems had already intervened. Detection data reveals mixed but concerning signals: 15 of 93 security vendors on VirusTotal flagged the domain, and it appeared on one security blocklist (PhishDestroy).

Trust scores from Gridinsoft and Scamadviser were both 0/100 and 1/100, respectively, reinforcing its malicious classification. The domain was explicitly categorized as a credential phishing site, though no specific brand impersonation was confirmed in available metadata. Technologies detected include HSTS, Cloudflare, and HTTP/3, typical of modern phishing infrastructure leveraging CDN services to evade takedowns. Defenders should treat this domain as a confirmed malicious indicator.

While it is currently offline, historical DNS and WHOIS records should be preserved for retrospective hunting. Block the domain and its resolved IP (172.66.47.95) at perimeter security controls, and monitor for any re-registration or re-emergence under similar naming patterns (e.g., hyroz-feral or meta-hyroz variants). If internal logs show user traffic to this domain prior to its takedown, initiate credential reset procedures for affected accounts, as the site was designed to harvest login credentials. No evidence of a specific phishing kit or targeted brand was present in the available data, limiting further attribution.