meta-magnet[.]pages[.]dev

This domain, meta-magnet.pages.dev, is identified as a credential theft operation targeting users through deceptive login portals. Analysis indicates no direct association with a specific brand or cryptocurrency drainer kit, but the infrastructure aligns with common credential harvesting tactics. The site mimics authentication pages to capture usernames, passwords, and potentially multi-factor authentication codes, which are then exfiltrated to attacker-controlled endpoints. Infrastructure analysis reveals the domain was registered on November 13, 2025, through Cloudflare, Inc. It resolves to the IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.) in the United States. The domain is flagged by 17 out of 95 security vendors on VirusTotal and appears on two security blocklists: PhishDestroy and PhishingDB. The SSL certificate is issued by Google Trust Services (WE1), a common provider for both legitimate and malicious domains. No Google Safe Browsing (GSB) detection was explicitly noted, but the blocklist presence confirms active malicious classification. As of the latest verification, meta-magnet.pages.dev has been taken offline, likely due to enforcement actions by the hosting provider or domain registrar. However, residual risk remains, as threat actors may migrate the credential theft infrastructure to new domains or subdomains. Users who interacted with the site should assume compromise of any submitted credentials and initiate password resets for associated accounts. Organizations are advised to block the domain, IP, and associated indicators at perimeter security controls to prevent further exposure.