meta-syron-kela-viro[.]pages[.]dev

Analysis indicates that meta-syron-kela-viro.pages.dev was registered through Cloudflare, Inc. on February 21, 2026 and is currently offline. The site presented the page title “Suspected phishing site | Cloudflare” and returned HTTP status 403 when accessed. The domain resolves to IP 172.66.47.24, which belongs to AS13335 operated by Cloudflare in the United States. TLS termination uses a certificate issued by Google Trust Services under the WE1 identifier, and the connection enforces HSTS while supporting HTTP/3. Reputation services assign extremely low scores: Gridinsoft reports 0/100 and Scamadviser reports 1/100.

The domain appears on a single security blocklist and is explicitly blocked by PhishDestroy. VirusTotal analysis shows that 15 of 93 scanned security vendors flagged the domain, confirming malicious intent. The identified scam type is credential phishing, aligning with the page title and the elevated risk rating. Nameserver records point to piper.ns.cloudflare.com and dakota.ns.cloudflare.com, consistent with the registrar’s infrastructure.

No additional indicators such as payload samples, phishing landing‑page screenshots, or victim reports are available, leaving the exact content of the phishing campaign unverified beyond the title. Defenders should add the domain and its associated IP address to blocklists, enforce DNS sinkholing where possible, and monitor for any re‑appearance or related subdomains. Continuous re‑scanning on VirusTotal and periodic checks of Cloudflare’s DNS records are recommended to detect potential re‑hosting. Given the low trust scores, presence on a blocklist, and vendor detections, the domain should be treated as malicious and excluded from user access.