meta-wyrox-delor[.]pages[.]dev

On 24 July 2026, the domain meta-wyrox-delor.pages.dev was observed hosting a suspected credential‑phishing page identified by the title “Suspected phishing site | Cloudflare”. The site was registered through Cloudflare, Inc. on 21 February 2026 and resolves to the IP address 172.66.47.121, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. TLS termination is provided by a Google Trust Services certificate issued under the WE1 framework, indicating that the connection was secured using industry‑standard encryption. HTTP responses returned a 403 status code, and the server advertised HTTP/3, HSTS, and Cloudflare‑specific headers, confirming the use of Cloudflare’s edge network. Malware and phishing detection services have flagged the domain.

VirusTotal recorded 16 detections out of 95 scanned security vendors, and the domain appears on at least one public blocklist. Independent reputation services assign extremely low scores: Gridinsoft reports 0 / 100 and Scamadviser 1 / 100, reflecting a high likelihood of malicious intent. The domain is currently listed as offline, and it has been blocked by the PhishDestroy sinkhole. Nameserver configuration uses troy.ns.cloudflare.com and nena.ns.cloudflare.com, both owned by Cloudflare, which is consistent with the registrar information. No additional infrastructure such as content delivery networks beyond Cloudflare, nor any secondary hosting, has been observed.

The limited data set does not reveal the exact phishing kit or the targeted brand, and the page content beyond the title has not been captured. Defenders should continue to block the domain at network perimeter and proxy layers, add the IP address 172.66.47.121 to deny lists, and monitor for any re‑registration attempts that reuse the same sub‑domain pattern. Threat‑intel feeds that reference the unique seed 1f6f3a can be correlated to identify related campaigns.