meta-vexor-1p5[.]pages[.]dev

On July 23, 2026 the domain meta-vexor-1p5.pages.dev was identified as a credential phishing site. The page title returned by the server is "Suspected phishing site | Cloudflare" and the HTTP response code is 403, indicating the content is presently inaccessible. Infrastructure analysis shows the domain resolves to IP address 188.114.96.3, which belongs to AS13335 operated by Cloudflare, Inc., and the hosting location is the United States. The domain was registered on February 21, 2026 through Cloudflare, Inc., using the authoritative nameservers seamus.ns.cloudflare.com and sureena.ns.cloudflare.com. TLS termination is provided by a Google Trust Services certificate issued to the WE1 organization, confirming the use of a legitimate certificate chain despite the malicious intent.

Threat intelligence from VirusTotal reports that 16 of 93 scanning vendors flag the domain, reinforcing the suspicion of phishing activity. The site is listed on PhishDestroy and appears on one additional security blocklist, and both Gridinsoft (0/100) and Scamadviser (1/100) assign it the lowest possible trust scores. The scam type is explicitly classified as credential phishing, and the risk level is elevated. All observed indicators—vendor detections, blocklist listings, low trust scores, and the Cloudflare‑provided page title—converge on a high‑confidence assessment that the domain is being used to harvest user credentials.

Uncertainties remain regarding the exact payload or credential capture mechanism because the site is offline and no content analysis is available beyond the generic title. Defenders should therefore treat any traffic to meta-vexor-1p5.pages.dev as malicious, enforce deny‑list rules at the DNS and firewall layers, and monitor for any future re‑activation. Continuous re‑scanning with multi‑vendor services is advised to capture any changes in the hosting or content.