meta-vonar-kyxel-drin[.]pages[.]dev

Analysis of the domain meta-vonar-kyxel-drin.pages.dev indicates it was a credential-phishing site hosted on Cloudflare Pages infrastructure. The domain, created on February 21, 2026, is now offline, returning an HTTP 403 status with the page title 'Suspected phishing site | Cloudflare.' It was flagged by one security blocklist (PhishDestroy) and detected by 14 of 93 security vendors on VirusTotal, confirming its classification as malicious. The domain resolved to the IP 172.66.45.12, associated with Cloudflare's AS13335 in the United States, and used Cloudflare nameservers (elisabeth.ns.cloudflare.com, jimmy.ns.cloudflare.com).

SSL certification was provided by Google Trust Services (WE1), and the site employed HSTS and HTTP/3 technologies, typical of Cloudflare-hosted properties. Scamadviser and Gridinsoft assigned trust scores of 1/100 and 0/100, respectively, further supporting its identification as a phishing threat. The exact content or targeted brand remains unconfirmed, as no specific brand or phishing kit details were provided in the available data.

Defenders should treat this domain as part of a credential-phishing campaign, particularly given its short lifespan and immediate takedown. While the site is no longer accessible, historical DNS and SSL records may still be useful for tracking related infrastructure or identifying compromised credentials. No evidence suggests persistence or lateral movement beyond this single domain.