meta-river-dc4[.]pages[.]dev

This domain, meta-river-dc4.pages.dev, is identified as a credential theft operation designed to harvest user login credentials through deceptive landing pages. Analysis indicates the infrastructure mimics legitimate authentication portals, likely targeting corporate or financial service users. No direct association with known cryptocurrency drainer kits or brand impersonation (e.g., Meta, Microsoft) has been confirmed, though the credential harvesting methodology aligns with broader phishing tactics observed in recent campaigns. Infrastructure analysis reveals the domain was registered on September 20, 2025, through Cloudflare, Inc., and resolves to the IP address 198.18.1.218, hosted under AS13335 (Cloudflare, Inc.) in the United States. Detection metrics show 17 out of 95 security vendors flagging the domain as malicious, with inclusion on two blocklists: PhishDestroy and PhishingDB. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the elevated risk posed by the domain. Google Safe Browsing (GSB) has not been explicitly referenced in available data, but the domain’s presence on multiple blocklists corroborates its malicious classification. As of the latest assessment, meta-river-dc4.pages.dev has been taken offline, likely following abuse reports or automated takedown mechanisms. However, residual risk persists due to potential reuse of the infrastructure or migration of the phishing kit to alternative domains. Users who may have interacted with the domain are advised to reset credentials for any accounts accessed during the exposure window, enable multi-factor authentication, and monitor for unauthorized activity. Organizations should update internal blocklists to include the domain and associated IP address to prevent future access attempts.