fb-login-acccounts-center-helps-metasbusiness-xassas[.]pages[.]dev

PhishDestroy's analysts have identified a credential phishing site hosted on pages.dev that mimics Meta’s Accounts Center to steal login credentials. This domain uses a string of words designed to appear legitimate at first glance—fb-login-acccounts-center-helps-metasbusiness-xassas.pages.dev—while actually directing victims to a fake login interface that captures usernames, passwords, and potentially second-factor tokens. The attacker’s goal is to gain access to real Meta accounts, which can then be abused for identity theft, financial fraud via connected payment methods, or social engineering against contacts. Google Safe Browsing has already flagged this page under the SOCIAL_ENGINEERING category, indicating active misuse. This domain was flagged by PhishDestroy on April 5, 2025, with 0 detections out of 95 scanners on VirusTotal as of that time. The site resolves to IP address 188.114.96.3, which is part of Cloudflare’s infrastructure, though the domain itself is registered through Cloudflare, Inc. The SSL certificate is issued by Google Trust Services, which may give a false sense of security due to its common issuance by legitimate services. Despite the certificate and hosting provider, behavioral patterns such as misspelled words (e.g., “acccounts” instead of “accounts”), excessive hyphenation, and the unusual subdomain structure signal malicious intent. The page is part of an active campaign with a uniquely tracked seed identifier: 398e78. If you visited this page or entered any information, immediately change your Meta password using only the official login portal at facebook.com or meta.com. Enable two-factor authentication with an authenticator app (not SMS) and review connected apps and payment methods in your Meta account settings. Scan your device for malware using reputable tools like Malwarebytes or Windows Defender. Report the incident to Meta through their official help center and consider enabling login alerts. Avoid clicking links in messages—always navigate directly to official sites. Use PhishDestroy’s domain lookup tool before interacting with any suspicious login pages to avoid credential theft.