meta-fenvor-sytron-havrel[.]pages[.]dev

This domain, meta-fenvor-sytron-havrel.pages.dev, is flagged as a generic phishing site specializing in credential harvesting. Analysis indicates no direct brand impersonation, suggesting a broad-spectrum phishing campaign targeting login credentials across multiple platforms. The infrastructure lacks identifiable drainer kit signatures, pointing to a custom or low-profile phishing framework designed to evade automated detection tools. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 198.18.2.53, hosted on AS13335 within the United States. It was registered through Cloudflare, Inc. on November 17, 2025, and secured with an SSL certificate issued by Google Trust Services (WE1). The domain appears on two security blocklists and is flagged by 18 of 95 security vendors on VirusTotal. Google Safe Browsing has marked this domain as malicious, further corroborating its phishing classification. Current status shows the domain has been taken offline, likely following detection and reporting. Response actions include blocking by multiple threat intelligence platforms and removal from active DNS resolution. Despite its offline status, residual risk remains due to potential cached DNS entries, browser history retention, or delayed propagation of blocklist updates. Users who accessed this domain prior to takedown should immediately revoke any entered credentials, enable multi-factor authentication on affected accounts, and monitor for unauthorized access attempts. Organizations should update internal blocklists to prevent future access attempts from network endpoints.