meta-larvin[.]pages[.]dev

meta-larvin.pages.dev was registered on February 21 2026 via Cloudflare, Inc. The domain resolves to the Cloudflare edge address 172.66.44.98, ASN 13335, located in the United States. A Google Trust Services certificate (WE1) secures the site, and HTTP responses return a 403 status code indicating that the page is being served by Cloudflare’s default block page titled “Suspected phishing site | Cloudflare”. VirusTotal analysis shows that 15 of 93 scanning engines flag the domain as malicious, and the domain is listed on a security blocklist and has been actively blocked by PhishDestroy. Reputation services assign extremely low trust scores (Scamadviser 1/100, Gridinsoft 0/100).

The site is classified as a credential‑phishing operation. Infrastructure detection reveals the use of HSTS, HTTP/3, and Cloudflare’s CDN services, a pattern commonly observed in fast‑flux or disposable phishing deployments. The domain is currently offline, and no additional page content has been captured, leaving the exact phishing lure and targeted brand unknown.

Defenders should add the hostname to network‑level deny lists, enforce TLS inspection to capture any future redirects, and monitor for new subdomains under the same parent zone. Because the domain uses Cloudflare’s shared IP space, blocking the IP address alone may impact legitimate services; therefore, rule sets should target the fully qualified domain name. Continuous threat‑intel feeds should be queried for any resurgence of the domain or related indicators, and incident response teams should be prepared to investigate any credential harvest attempts that reference this domain.