meta-pronyl[.]pages[.]dev

This domain is flagged as a high-risk credential harvesting phishing site targeting user authentication credentials. Analysis indicates the infrastructure was specifically designed to mimic legitimate login portals, likely for financial or social media account compromise. The threat type falls under targeted credential theft, with no observed malware distribution or exploit delivery at this time.

Infrastructure analysis reveals the domain meta-pronyl.pages.dev was registered through Cloudflare on October 17, 2025, and resolves to IP address 172.66.47.49 (AS13335, United States). The SSL certificate is issued by Google Trust Services (WE1). Detection metrics show 17/95 security vendors on VirusTotal flagging the domain as malicious. The domain appears on two security blocklists (PhishDestroy and PhishingDB) and is actively blocked by Google Safe Browsing for phishing activity. The page title "Suspected phishing site | Cloudflare" suggests automated detection by the hosting provider prior to takedown.

Mitigation requires immediate domain blocking at network perimeter and endpoint levels. Security teams should invalidate any credentials potentially exposed to this infrastructure, particularly if users reported interaction with the domain. Review authentication logs for connections to 172.66.47.49 between October 17 and the takedown date. Implement enhanced monitoring for similar Cloudflare Pages subdomains with "-pronyl" patterns. User awareness training should emphasize identifying suspicious login pages, especially those hosted on content delivery networks or cloud platforms.