meta-wyson-kirel[.]pages[.]dev

Analysis of meta-wyson-kirel.pages.dev shows a domain that was created on February 21, 2026 and immediately hosted behind Cloudflare’s edge network (AS13335, United States). The domain resolves to the IP address 188.114.97.3, which belongs to Cloudflare, Inc., and the DNS configuration uses the default Cloudflare nameservers teresa.ns.cloudflare.com and louis.ns.cloudflare.com. The site presents the page title "Suspected phishing site | Cloudflare" and returns an HTTP 403 status, indicating that the content is being blocked or taken offline. Infrastructure fingerprints include HTTP/3 support and enforced HSTS, both typical of Cloudflare‑protected sites. The SSL certificate is issued by Google Trust Services under the WE1 identifier, confirming a valid TLS handshake but offering no indication of malicious intent beyond the hosting context.

Threat intelligence flags the domain as a credential phishing operation. It appears on a single security blocklist and is actively blocked by PhishDestroy. Reputation services assign an extremely low trust score—Scamadviser rates the domain 1/100 and Gridinsoft assigns 0/100—reflecting the consensus that the site is malicious. VirusTotal analysis shows that 15 of 93 scanning engines have flagged the domain, reinforcing the phishing classification.

While the site is currently offline, the observable indicators—registration through Cloudflare, the suspicious page title, low trust scores, blocklist presence, and multiple vendor detections—provide concrete evidence of a phishing infrastructure. Defenders should continue to block the domain at network perimeter devices, update URL filtering policies, and monitor for any re‑activation or similar domains registered under the same registrar or using the same Cloudflare nameservers. Ongoing threat hunting should include correlating any credential harvesting attempts with the IP 188.114.97.3 and reviewing logs for traffic to this host.