meta-valex-nyron[.]pages[.]dev

The domain meta-valex-nyron.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. and resolves to the Cloudflare‑owned address 172.66.46.208 (AS13335, United States). The site served over HTTPS using a Google Trust Services WE1 certificate and employed HSTS and HTTP/3, indicating a modern Cloudflare configuration. A request to the root URL returned HTTP 403, and the page title presented by the server is “Suspected phishing site | Cloudflare”, a generic placeholder used by Cloudflare when a site is taken down for policy violations. The domain is currently offline; the status flag shows “taken offline” and the HTTP response confirms the block. Reputation services rate the domain extremely poorly, with Scamadviser assigning a trust score of 1 / 100 and Gridinsoft reporting 0 / 100.

VirusTotal analysis shows that 16 of 93 scanned security vendors flagged the domain as malicious, and the domain appears on one external blocklist. PhishDestroy has also listed the domain as blocked. Nameservers are galilea.ns.cloudflare.com and joel.ns.cloudflare.com, both standard Cloudflare delegations. Available evidence points to a credential‑phishing campaign, though the exact target brand or luring technique cannot be confirmed because the site content was not captured before takedown. The combination of a newly created domain, low reputation scores, multiple vendor detections, and a Cloudflare “suspected phishing” page title aligns with known patterns of automated phishing infrastructure.

Uncertainty remains regarding the specific phishing kit, the victim cohort, and any associated command‑and‑control infrastructure, as no payloads or URLs beyond the landing page have been observed. Defenders should immediately add meta-valex-nyron.pages.dev to deny‑list rules at DNS and proxy layers, monitor for any future re‑registration of the same sub‑domain pattern, and continue to track the associated IP 172.66.46.208 for anomalous traffic.