meta-msk-io-learn-login[.]pages[.]dev

This domain, meta-msk-io-learn-login.pages.dev, is identified as a credential phishing site designed to harvest user login credentials through a fake authentication interface. Analysis indicates the page impersonated a legitimate service portal, likely leveraging social engineering tactics to deceive victims into entering sensitive information. No direct evidence of a crypto drainer kit or wallet-draining functionality was observed, though credential theft remains the primary objective. The domain exhibits characteristics of a low-sophistication but high-impact phishing campaign, potentially targeting users of cloud-based platforms or educational services. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 188.114.96.3, hosted under AS13335 (Cloudflare, Inc.), and was registered on October 28, 2025. The SSL certificate is issued by Google Trust Services (WE1), a common feature in phishing domains to mimic legitimacy. Detection metrics show 16 out of 95 security vendors flagged the domain on VirusTotal, while it appears on one additional security blocklist. Google Safe Browsing status is not explicitly confirmed, but the domain has been blocked by at least one threat intelligence feed. The page title, 'Suspected phishing site | Cloudflare,' suggests Cloudflare’s automated detection systems may have intervened prior to external takedown efforts. As of the latest assessment, meta-msk-io-learn-login.pages.dev has been taken offline, likely due to Cloudflare’s enforcement actions or domain suspension. While the immediate threat is neutralized, residual risk persists for users who may have interacted with the site before its removal. Organizations and individuals are advised to monitor for unauthorized access attempts, rotate credentials associated with the impersonated service, and implement multi-factor authentication where possible. Network defenders should update blocklists with the domain and IP address, while users should verify the legitimacy of login portals through official channels before entering credentials.