meta-gelvin[.]pages[.]dev

On July 24, 2026, analysis identified meta-gelvin.pages.dev as a high‑risk credential phishing site that is currently offline. The domain was registered on February 21, 2026 through Cloudflare, Inc., and resolves to the Cloudflare edge address 188.114.96.3 located in the United States under ASN 13335. DNS is served by indie.ns.cloudflare.com and weston.ns.cloudflare.com, and the site employed HSTS and HTTP/3, confirming the use of modern Cloudflare infrastructure. The TLS certificate presented by the server is issued by Google Trust Services (WE1), indicating a legitimate certificate chain but not mitigating the malicious intent.

HTTP requests to the site returned a 403 status code, and the page title displayed "Suspected phishing site | Cloudflare," which aligns with the classified scam type of credential phishing. Cross‑vendor threat feeds flag the domain: Google Safe Browsing lists it for social engineering, 14 of 93 VirusTotal scanners reported malicious activity, and PhishDestroy has blocked the domain. Additional reputational metrics are extremely low, with Gridinsoft scoring 0/100 and Scamadviser scoring 1/100, and the domain appears on one external blocklist. The evidence confirms that the domain was used for credential harvesting, though the specific target brand or lure content has not been disclosed in the available data.

The offline status suggests the operators have either withdrawn the site or are rotating infrastructure. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑registration or similar sub‑domains, and advise users to avoid clicking links that resolve to the associated IP range. Ongoing telemetry from Cloudflare edge logs and threat‑intel feeds should be correlated to detect potential re‑use of the same hosting profile.