meta-zenithra[.]pages[.]dev

This domain, meta-zenithra.pages.dev, was identified as a credential harvesting phishing site designed to deceive users into submitting login credentials, financial details, or other sensitive information. The infrastructure was structured to mimic legitimate authentication portals, likely targeting users of popular online services or financial platforms. Analysis indicates the site employed social engineering tactics, such as urgency or authority impersonation, to manipulate victims into disclosing confidential data. Evidence supporting this assessment includes detections from 13 out of 95 security vendors on VirusTotal, with the domain appearing on two security blocklists. The domain was registered through Cloudflare, Inc. on October 06, 2025, and resolved to the IP address 172.66.44.79, hosted on infrastructure belonging to AS13335. The SSL certificate was issued by Google Trust Services (WE1), a common practice among phishing operators to lend an appearance of legitimacy. Additionally, the domain was flagged by Google Safe Browsing as phishing and blocked by at least two threat intelligence feeds. Users who visited meta-zenithra.pages.dev or interacted with its content should take immediate action to mitigate potential risks. If credentials or financial information were entered, affected accounts should be secured by changing passwords and enabling multi-factor authentication where available. Monitoring for unauthorized transactions or account activity is recommended. Devices used to access the site should be scanned for malware, as phishing pages may distribute secondary payloads. Organizations should update security controls to block the domain and its associated IP address to prevent further exposure.