meta-kevril[.]pages[.]dev

meta-kevril.pages.dev was created on 21 February 2026 and registered through Cloudflare, Inc. The authoritative nameservers are melnicoff.ns.cloudflare.com and maeve.ns.cloudflare.com, both owned by Cloudflare. DNS resolves to 188.114.97.3, an IP address belonging to AS13335 (Cloudflare) located in the United States. The site presented a TLS certificate issued by Google Trust Services under the WE1 label, indicating a valid HTTPS configuration despite the malicious intent. An HTTP request returned status code 403, suggesting the page is deliberately inaccessible or blocked. The page title returned by the server is "Suspected phishing site | Cloudflare", and the classified scam type is Credential Phishing.

Reputation services show extremely low trust scores: Gridinsoft rates the domain 0/100 and Scamadviser 1/100. Google Safe Browsing flags the domain for social-engineering content. VirusTotal records 16 of 93 scanning engines labeling the domain as malicious, confirming a consensus of detection. The domain appears on a single public blocklist, PhishDestroy, and has been reported as offline at the time of this assessment.

Uncertainty remains around any active payloads or credential-stealing pages that may have been hosted before takedown, as the current HTTP 403 response prevents direct content analysis. Defenders should continue to block the domain at perimeter filters, update intrusion-detection signatures to include the IP 188.114.97.3 and associated Cloudflare nameservers, and monitor for any future re-registration attempts that reuse the same sub-domain pattern. Observers should also consider adding the domain to internal watch lists and correlating any login-related alerts with this indicator, especially for attempts targeting credential harvesting. The evidence suggests a high-risk credential-phishing operation that has already been taken offline, but residual risk persists through possible cached or redirected requests.