meta-pyrin[.]pages[.]dev

meta-pyrin.pages.dev is currently flagged as a credential phishing infrastructure. The domain was registered on 07 November 2025 through Cloudflare, Inc., and it resolves to the IP address 172.66.47.155, which belongs to AS13335 Cloudflare, Inc. in the United States. Cloudflare’s DNS configuration is evident from the nameservers elaine.ns.cloudflare.com and javier.ns.cloudflare.com, and the service presents HSTS, HTTP/3, and a TLS certificate issued by Google Trust Services under the WE1 label. An HTTP request to the site returns a 403 status code, and the page title presented by the server is “Suspected phishing site | Cloudflare”.

VirusTotal has recorded detections from 15 of 95 security vendors, indicating a moderate level of suspicion among scanning engines. The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy service. Gridinsoft’s trust scoring assigns a value of 0 out of 100, reinforcing the malicious assessment.

The site is presently taken offline, as indicated by the “offline” status, but the underlying infrastructure remains observable. Defenders should block traffic to 172.66.47.155 and any sub‑domains of meta‑pyrin.pages.dev, monitor for potential re‑use of the Cloudflare‑hosted IP range, and incorporate the domain into URL filtering rules. Because the phishing content itself has not been captured, analysts should continue to watch for re‑appearance or related domains created after the November 2025 registration date, and verify that any credential capture attempts referencing this domain are promptly quarantined.