meta-trivo-hylen[.]pages[.]dev

Analysis of meta-trivo-hylen.pages.dev indicates a credential phishing operation hosted on Cloudflare Pages infrastructure. The domain was registered on February 21, 2026, through Cloudflare, Inc., and resolves to IP 188.114.96.3 (AS13335, US). Nameservers are troy.ns.cloudflare.com and nena.ns.cloudflare.com. The SSL certificate is issued by Google Trust Services (WE1), and HTTP Strict Transport Security (HSTS) is enforced alongside HTTP/3 support.

The domain is currently offline, returning an HTTP 403 status with the page title 'Suspected phishing site | Cloudflare.' Security vendor detections are limited but notable: 15 of 93 engines on VirusTotal flagged the domain as malicious. Gridinsoft assigned a trust score of 0/100, while Scamadviser rated it 1/100. The domain appears on one security blocklist, specifically PhishDestroy. No specific brand impersonation or phishing kit details are confirmed in the available data, though the scam type is classified as credential phishing.

The exact content or target of the phishing attempt remains unanalyzed due to the domain's offline status. Defenders should treat this domain as high-risk for credential harvesting. Block access at the network level, monitor for related indicators (IP 188.114.96.3, Cloudflare Pages subdomains), and review logs for connections to this domain prior to its takedown. The use of Cloudflare infrastructure and HSTS suggests an attempt to appear legitimate, though the low trust scores and blocklist inclusion confirm malicious intent.