meta-zarvo[.]pages[.]dev

The domain meta-zarvo.pages.dev was registered on November 07, 2025 through Cloudflare, Inc. and is hosted on Cloudflare's network (AS13335) with the IP address 172.66.47.173 located in the United States. The site presented the page title "Suspected phishing site | Cloudflare" and employed TLS certificates issued by Google Trust Services under the WE1 root, indicating that HTTPS was correctly terminated. Detected technologies include HSTS, Cloudflare edge services, and HTTP/3, all consistent with a typical Cloudflare‑protected site.

Security telemetry shows the domain appears on a single blocklist, specifically PhishDestroy, and has been flagged by 16 of 95 VirusTotal security vendors, reinforcing its malicious reputation. The Gridinsoft trust score of 0 out of 100 further reflects a highly untrusted status. An HTTP 403 response was observed, and the current operational state is listed as offline, suggesting the site has been taken down or is no longer serving content.

While the page title and blocklist inclusion identify the activity as credential phishing, no additional details about the targeted brand or the specific credential‑harvesting mechanism have been disclosed. Defenders should continue to block the domain at perimeter filters, monitor any DNS queries for the associated Cloudflare nameservers (isaac.ns.cloudflare.com, raina.ns.cloudflare.com), and correlate any outbound connections to the IP 172.66.47.173 with potential data exfiltration attempts. Ongoing vigilance is advised because the infrastructure could be reused with a different payload or domain, and the lack of live content limits immediate forensic analysis of the phishing payload.