meta-drelo[.]pages[.]dev

meta-drelo.pages.dev is a credential‑phishing domain that was registered on November 7 2025 through Cloudflare, Inc. The domain resolves to the Cloudflare‑owned address 172.66.47.64, which is associated with ASN 13335 and located in the United States. The site serves a TLS certificate issued by Google Trust Services (WE1), and the HTTP response currently returns a 403 status code with HSTS, Cloudflare and HTTP/3 headers observed. The page title presented by the server is “Suspected phishing site | Cloudflare,” indicating that the content has been taken down or flagged by the provider. VirusTotal has recorded 16 detections out of 95 scanned security vendors, and the domain appears on a single public blocklist. PhishDestroy has also listed the domain as blocked.

Reputation scoring from Gridinsoft gives a 0 / 100 trust rating, reinforcing the malicious classification. Nameservers camilo.ns.cloudflare.com and uma.ns.cloudflare.com are both Cloudflare‑managed, confirming that the infrastructure is fully hosted on Cloudflare’s edge network. The available evidence points to a credential‑phishing campaign, but the specific target brand or the exact phishing payload has not been disclosed in the collected data. Because the site is presently offline, active exploitation cannot be confirmed at this moment, yet the presence of multiple vendor detections and a zero‑trust score suggests that the domain was used for malicious credential harvesting.

Defenders should immediately add meta-drelo.pages.dev to deny lists and ensure that any outbound traffic to the IP 172.66.47.64 is blocked at the network perimeter. Continuous monitoring of Cloudflare‑hosted subdomains that share the same nameservers or ASN is advisable, as threat actors often generate new pages under the same infrastructure. Updating security appliances with the latest blocklist entries, including those from PhishDestroy, will help prevent inadvertent user exposure.