meta-tylos-ferna[.]pages[.]dev

This domain, meta-tylos-ferna.pages.dev, is flagged as a credential harvesting phishing site targeting undisclosed brands. Analysis indicates the infrastructure was designed to mimic legitimate login portals, likely deploying form-based data exfiltration to capture user credentials. No specific brand impersonation or drainer kit signatures were identified in available telemetry, though the generic phishing classification suggests broad targeting of authentication flows. Infrastructure analysis reveals the domain was registered on November 15, 2025, through Cloudflare, Inc. and resolves to IP address 172.66.45.29, hosted on AS13335 (Cloudflare, Inc.) in the United States. Security vendor detections on VirusTotal report 16/95 flags, while the domain appears on two security blocklists: PhishDestroy and PhishingDB. The SSL certificate is issued by Google Trust Services (WE1), and the page title was observed as 'Suspected phishing site | Cloudflare,' indicating automated detection by the hosting provider. No entries were found in Google Safe Browsing at the time of analysis. The domain is currently offline, likely following takedown action by the hosting provider or registrar. While the immediate threat has been mitigated, residual risk remains for users who may have interacted with the site prior to deactivation. Organizations are advised to review logs for connections to 172.66.45.29 and meta-tylos-ferna.pages.dev, and to monitor for credential reuse attempts. Security teams should update blocklists to include this domain and associated IP, and conduct user awareness training on recognizing phishing attempts, particularly those leveraging cloud-hosted infrastructure.