meta-carvon[.]pages[.]dev

This domain, meta-carvon.pages.dev, is identified as a credential harvesting phishing site designed to deceive users into submitting sensitive login credentials through fraudulent web interfaces. Analysis indicates the infrastructure was specifically engineered to mimic legitimate authentication portals, likely targeting corporate or financial service users. The threat actor appears to have employed social engineering tactics, such as urgency or authority impersonation, to manipulate victims into entering usernames, passwords, and potentially multi-factor authentication codes. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered through a privacy-protected service on October 16, 2025, and resolves to the IP address 188.114.97.3, associated with a content delivery network provider. Security vendors on VirusTotal flagged the domain at a ratio of 17 out of 95, with detection engines specifically classifying it as phishing. The domain appears on two independent security blocklists, including PhishDestroy and PhishingDB, further corroborating its malicious intent. The SSL certificate, issued by Google Trust Services (WE1), was likely obtained to lend an appearance of legitimacy to the fraudulent site. Users who visited meta-carvon.pages.dev should immediately take corrective actions to mitigate potential account compromise. Any credentials entered on the site must be considered exposed and should be changed across all platforms where they were reused. Multi-factor authentication tokens generated during the suspected compromise window should be revoked and reissued. System logs should be reviewed for unauthorized access attempts, particularly within 24 hours of the visit. If financial or corporate accounts were accessed through the phishing site, affected organizations should initiate incident response protocols, including password resets, session invalidation, and monitoring for anomalous activity. The domain has been taken offline, but users should remain vigilant for similar threats employing comparable infrastructure patterns.