io-mask-meta-login[.]pages[.]dev

Analysis of the domain io-mask-meta-login.pages.dev indicates a confirmed credential phishing campaign targeting Meta (Facebook) users, as evidenced by its naming convention and scam classification. The domain was registered on February 21, 2026, through Cloudflare, Inc., and is hosted on Cloudflare's infrastructure (AS13335), resolving to the IP address 172.66.44.92, located in the United States. The domain's nameservers, roan.ns.cloudflare.com and laila.ns.cloudflare.com, further confirm its association with Cloudflare's hosting services. The SSL certificate is issued by Google Trust Services (WE1), a common feature in phishing domains leveraging legitimate CDN services to evade detection. As of July 23, 2026, the domain has been taken offline, returning an HTTP 403 status with the page title 'Suspected phishing site | Cloudflare,' suggesting intervention by the hosting provider or security vendors.

This assessment is supported by detection data: 13 of 93 security vendors on VirusTotal flagged the domain as malicious, and it appears on at least one security blocklist, specifically PhishDestroy. The Gridinsoft trust score of 0/100 reinforces the domain's high-risk classification. Technologies detected on the domain include HSTS, Cloudflare, and HTTP/3, which are consistent with modern phishing infrastructure designed to appear legitimate. The absence of additional brand-specific indicators or visual analysis limits further classification of the phishing kit or exact user interaction flow.

However, the domain's naming pattern ('meta-login') and scam type (credential phishing) strongly suggest an intent to harvest Meta account credentials. Defenders should treat this domain as a confirmed phishing threat. Blocking the domain and its associated IP (172.66.44.92) at the network level is recommended, alongside monitoring for related subdomains or newly registered domains with similar naming conventions.