meta-lirvon[.]pages[.]dev

The domain meta-lirvon.pages.dev has been identified as a generic phishing threat, currently offline after being taken down. The page displayed a 'Suspected phishing site' warning by Cloudflare, indicating that the hosting provider or security systems intervened. This domain was created on October 17, 2025, registered through Cloudflare, Inc., and resolves to IP address 172.66.44.60. Its SSL certificate is issued by Google Trust Services (WE1), which is common for legitimate sites but can also be abused by phishing actors.

VirusTotal analysis shows that 16 out of 95 security vendors flagged this domain as malicious, and Google Safe Browsing specifically marks it as phishing. The domain appears on two security blocklists, further corroborating its malicious nature. The domain's registration through Cloudflare, a popular CDN and registrar, does not inherently indicate legitimacy, as threat actors often abuse such services to evade detection. The IP address 172.66.44.60 is associated with Cloudflare's infrastructure, making it harder to trace the true origin of the phishing operation.

Given that the domain is now offline, the immediate risk of further phishing attacks from this specific URL is low. However, similar domains may be created under the same pattern. Users who encountered this domain and entered any credentials should change those passwords immediately and enable two-factor authentication where possible. Organizations should monitor for any related domains or subsequent phishing attempts. PhishDestroy recommends blocking the domain and IP 172.66.44.60 at the network level and educating users about generic phishing tactics that often impersonate popular services.