fxa-hmd-biz3-rkp-zvn-sp4ect1[.]pages[.]dev

This domain, fxa-hmd-biz3-rkp-zvn-sp4ect1.pages.dev, is identified as a credential theft operation impersonating Meta for Business services. Analysis of the page title, Meta for Business | Page Appeal, confirms the fraudulent intent to mimic legitimate Meta branding, likely targeting business account holders with phishing forms designed to harvest login credentials. No direct evidence of a crypto drainer kit or wallet redirection was observed, but the infrastructure aligns with known credential harvesting campaigns leveraging cloud hosting for rapid deployment and takedown evasion. Infrastructure analysis reveals the domain was registered on January 02, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.44.109, hosted on AS13335 (Cloudflare, Inc.) in the United States. The domain appears on one security blocklist and is flagged by 13 out of 95 security vendors on VirusTotal, indicating moderate detection but persistent risk. The SSL certificate is issued by Google Trust Services (WE1), a common practice among phishing domains to appear legitimate. No Google Safe Browsing (GSB) listing was confirmed at the time of assessment, though this may reflect a lag in propagation rather than absence of threat. The domain has been taken offline and blocked by automated mitigation systems, reducing immediate exposure to end users. However, the underlying infrastructure remains a residual risk, as threat actors frequently reuse hosting providers and IP ranges for subsequent campaigns. Organizations are advised to monitor for similar domains leveraging Cloudflare Pages or other cloud-based hosting services, particularly those impersonating Meta or other high-value brands. Network-level blocking of the resolved IP (172.66.44.109) and associated CIDR ranges is recommended as a proactive measure. Users should verify the authenticity of Meta for Business portals by cross-referencing URLs with official Meta domains and enabling multi-factor authentication to mitigate credential theft risks.