meta-nelvinar[.]pages[.]dev

Analysis of meta-nelvinar.pages.dev indicates that the domain is currently offline but exhibits multiple indicators of malicious intent consistent with credential phishing. The domain was created on 21 February 2026 and is hosted behind Cloudflare’s network (ASN 13335) with the IP address 188.114.97.3 located in the United States. DNS resolution uses Cloudflare‑owned nameservers imani.ns.cloudflare.com and walt.ns.cloudflare.com, and the site served HSTS headers and HTTP/3, confirming the use of Cloudflare’s security and performance stack. An HTTP request to the site returns a 403 status code, which is typical for blocked or takedown pages hosted by Cloudflare’s “Access Denied” page, and the page title returned is “Suspected phishing site | Cloudflare”, directly labeling the content as phishing. The SSL certificate is issued by Google Trust Services under the WE1 trust chain, a common certificate for Cloudflare‑proxied sites, and does not provide additional reputation signals.

Reputation services have assigned extremely low trust scores: Gridinsoft rates the domain 0/100, and ScamAdviser assigns 1/100, both indicating a high likelihood of abuse. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy feed. VirusTotal reports that 15 of 95 scanned security vendors flag the domain, reinforcing the malicious classification. The declared scam type is credential phishing, suggesting that the site was intended to harvest user credentials, although the exact target brand or login page is not disclosed in the available data. Uncertainty remains regarding the current content because the site is offline and no visual or functional analysis is possible.

No additional intelligence such as OTX tags, Safe Browsing alerts, or detailed payloads has been published. Consequently, defenders should continue to treat the domain as hostile. Recommended actions include adding the domain and its associated IP address 188.114.97.