meta-prilo-hyvox[.]pages[.]dev

The domain meta-prilo-hyvox.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. and resolves to 188.114.97.3, an IP address owned by Cloudflare (AS13335) located in the United States. The site served an HTTP 403 response and presented the page title “Suspected phishing site | Cloudflare”. The TLS certificate is issued by Google Trust Services under the WE1 identifier, confirming a valid HTTPS endpoint. Reputation services assign extremely low trust scores: Scamadviser 1/100 and Gridinsoft 0/100.

VirusTotal records indicate that 16 of 93 scanned security vendors flagged the domain, reinforcing the malicious classification. The domain is listed on a single public blocklist, PhishDestroy, and has been taken offline at the time of analysis. Detected technologies include HSTS, Cloudflare CDN, and HTTP/3 support. The observed attributes align with the “Credential Phishing” classification noted in the intelligence.

No additional evidence such as payload samples, phishing page screenshots, or victim reports is currently available. Defenders should continue to block the domain at perimeter filters, monitor for any re‑activation, and consider adding the IP address 188.114.97.3 to deny lists, especially for services that rely on Cloudflare‑hosted infrastructure. Ongoing observation of Cloudflare‑associated IP ranges for similar patterns is recommended, as the low trust scores and vendor detections suggest the domain was part of a broader credential‑stealing campaign.