meta-syvox[.]pages[.]dev

The domain meta-syvox.pages.dev was registered through Cloudflare, Inc. on 21 February 2026 and is currently marked as offline. DNS resolution points to the Cloudflare edge address 172.66.44.177, which belongs to AS13335 (Cloudflare, Inc.) and is located in the United States. Both authoritative nameservers are hosted by Cloudflare (peyton.ns.cloudflare.com and pat.ns.cloudflare.com), indicating that the attacker leveraged Cloudflare’s free hosting and DNS services to conceal the true backend location. The site presents a TLS certificate issued by Google Trust Services under the WE1 common name, confirming that transport encryption is in place despite the malicious intent. HTTP responses return a 403 status code, and the server advertises HSTS and HTTP/3, consistent with Cloudflare‑provided security headers.

The page title returned by the server is “Suspected phishing site | Cloudflare”, which is a generic placeholder displayed by Cloudflare when a site has been taken down for policy violations. Reputation services rate the domain extremely poorly: Gridinsoft assigns a trust score of 0 / 100, and Scamadviser scores it 1 / 100. The domain appears on one public security blocklist and is listed by PhishDestroy as a credential‑phishing indicator. VirusTotal analysis shows that 16 of 93 scanned security vendors flagged the domain, reinforcing the classification as a phishing resource.

No additional intelligence such as Safe Browsing or OTX identifiers was supplied. Given the available evidence, the primary risk is credential harvesting; the exact phishing landing page content remains unknown because the site is offline. Defenders should block the domain and its resolving IP at perimeter firewalls, update URL filtering rules, and monitor Cloudflare edge ranges for similar activity. Continuous re‑evaluation is advised in case the attacker re‑hosts the payload on a different subdomain or changes the underlying infrastructure.