meta-xylo[.]pages[.]dev

The domain meta-xylo.pages.dev was observed serving a page whose title reads “Suspected phishing site | Cloudflare”. Technical analysis shows the site was hosted on Cloudflare’s network (ASN 13335) and resolved to the IPv4 address 172.66.44.128, which geolocates to the United States. Registration records indicate the domain was created on 7 November 2025 and was registered through Cloudflare, Inc., using the Cloudflare‑provided name servers isaac.ns.cloudflare.com and raina.ns.cloudflare.com. The HTTP response returned a 403 status code, and the site is currently reported as offline. The TLS certificate presented is issued by Google Trust Services under the WE1 label, confirming a valid HTTPS endpoint.

Header inspection reveals the deployment of HTTP Strict Transport Security and support for HTTP/3, reflecting a modern web stack but offering no mitigation against credential‑phishing attempts. Reputation data assigns a Gridinsoft trust score of 0 / 100, and VirusTotal reports that 16 of 95 scanned security vendors flagged the domain as malicious. The domain appears on a single public blocklist and has been explicitly blocked by the PhishDestroy service. The identified scam type is credential phishing, indicating the intent to harvest user login details, although the exact fields or target brand have not been captured beyond the page title.

Because the page content has not been archived, the specific phishing vector (e.g., login form, spoofed URL) remains unknown. Defenders should continue to block the domain at network perimeters, add the originating IP address to deny‑list rules, and monitor for any re‑registration attempts of the same second‑level domain. Ongoing surveillance of Cloudflare‑hosted assets associated with ASN 13335 is recommended, as threat actors frequently recycle this infrastructure for subsequent campaigns.