meta-keru-vilon[.]pages[.]dev

On July 25, 2026, the domain meta-keru-vilon.pages.dev was identified as a credential phishing site. This domain was registered through Cloudflare, Inc. on February 21, 2026. The domain infrastructure includes nameservers anahi.ns.cloudflare.com and bill.ns.cloudflare.com, and it resolves to the IP address 188.114.97.3, which is located in the United States and is part of the AS13335 Cloudflare, Inc. network. The SSL certificate for this domain is issued by Google Trust Services and operates under the WE1 security policy. As of the reporting date, the domain is offline and returns an HTTP status code 403, indicating that access is forbidden.

This suggests the domain has been taken down, either by Cloudflare or due to takedown efforts by security organizations. However, the risk level is still considered elevated due to its history and the nature of the threat. The page title is listed as 'Suspected phishing site | Cloudflare,' which further supports the suspicion of malicious intent. The domain has been flagged by 16 of 93 security vendors on VirusTotal, and it appears on one security blocklist. Additionally, the site is blocked by PhishDestroy, a known anti-phishing service.

Trust scores from ScamAdviser and Gridinsoft are 1/100 and 0/100, respectively, indicating a high level of risk. While the exact content of the site is not yet analyzed, the evidence strongly suggests that the domain was used for credential phishing, attempting to steal sensitive information such as usernames and passwords. Defenders should ensure that this domain is blocked in their network security configurations and educate users about the dangers of credential phishing to prevent potential exposure to similar threats. Regular monitoring for any reappearance of the domain or similar patterns in network traffic is also recommended.