meta-synor-dravek[.]pages[.]dev

Analysis of meta-synor-dravek.pages.dev indicates that the domain was provisioned on February 21, 2026 through Cloudflare, Inc. and resolves to the IP address 172.66.44.97, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presents a Cloudflare‑issued SSL certificate signed by Google Trust Services (WE1) and enforces HTTP Strict Transport Security (HSTS) while supporting HTTP/3. An HTTP request to the domain returns a 403 status code, and the page title returned by the server is "Suspected phishing site | Cloudflare," suggesting that the content was flagged by Cloudflare's automated detection mechanisms. VirusTotal scans have recorded 16 detections out of 95 security vendors, confirming that multiple anti‑malware engines recognize the domain as malicious.

The domain is listed on at least one external blocklist, specifically PhishDestroy, and appears on a single additional security blocklist, reinforcing its categorization as a phishing infrastructure. Reputation services assign extremely low trust scores, with Scamadviser reporting 1 out of 100 and Gridinsoft rating the domain at 0 out of 100, both indicative of a high‑confidence malicious site. The overall threat type is identified as a brand‑impersonation phishing campaign, although the targeted brand is not disclosed in the available data.

The current operational status is offline, and the site has been taken down. Defenders should continue to block the domain at network perimeters, update URL filtering feeds with the observed indicators, and monitor for any resurgence of the domain or related aliases. Additional investigation is warranted if new content appears, but based on the existing evidence the domain poses an elevated risk and should be treated as hostile.