meta-quay[.]pages[.]dev

This domain, meta-quay.pages.dev, is identified as a credential harvesting phishing site targeting users through deceptive login interfaces. Analysis indicates the domain was designed to mimic legitimate authentication portals, tricking visitors into submitting sensitive credentials such as usernames, passwords, and potentially multi-factor authentication codes. The infrastructure was configured to capture and exfiltrate this data to unauthorized third parties, posing a direct risk of account compromise and subsequent unauthorized access to linked services or financial platforms. Evidence supporting this assessment includes detection by 15 out of 95 security vendors on VirusTotal, registration through Cloudflare, Inc. on October 18, 2025, and presence on two independent security blocklists. The domain resolved to the IP address 172.66.47.106, hosted on infrastructure belonging to AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate, issued by Google Trust Services (WE1), was valid but does not mitigate the malicious intent of the underlying content. Additional intelligence sources, including PhishDestroy and PhishingDB, have independently flagged this domain, reinforcing its classification as a confirmed phishing asset. Users who visited meta-quay.pages.dev or submitted credentials through any interface hosted on this domain should immediately take corrective action. All exposed credentials must be considered compromised and should be changed without delay across all platforms where the same or similar passwords were used. Enable multi-factor authentication on critical accounts, and monitor for unauthorized access or transactions. If personal or financial data was entered, review account statements and credit reports for signs of misuse. System scans for malware are recommended, as phishing sites may deploy additional payloads. Network administrators should block the domain and associated IP at the perimeter to prevent further exposure.