id48[.]partner-agency-network[.]com

This domain, id48.partner-agency-network.com, poses a significant credential theft risk by impersonating the Meta Business Help Centre. Analysis indicates it is designed to harvest login credentials from unsuspecting users who believe they are accessing legitimate Meta business support services. The site mimics official Meta branding, including logos and page layout, to deceive visitors into entering sensitive account information, which is then captured by threat actors for unauthorized access or further malicious activities such as account takeovers or financial fraud. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered on October 31, 2025, through GRANSY S.R.O D/B/A SUBREG.CZ, a registrar frequently associated with abusive domains. It resolves to the IP address 104.21.50.213, hosted on Cloudflare’s network (AS13335), which is commonly used to obscure malicious infrastructure. The domain lacks an SSL certificate, a critical security gap that exposes user data to interception. Security vendors have flagged this domain on VirusTotal, with 20 out of 95 engines detecting it as malicious. Additionally, it appears on two security blocklists and is explicitly blocked by PhishDestroy and PhishingDB, further confirming its fraudulent nature. If you visited id48.partner-agency-network.com or entered any credentials on the site, immediate action is required to mitigate risk. First, change the passwords for any accounts accessed or entered on the site, prioritizing Meta Business or Facebook accounts. Enable multi-factor authentication (MFA) on all critical accounts to prevent unauthorized access. Monitor linked accounts for suspicious activity, such as unauthorized logins or transactions, and report any anomalies to the respective platform’s security team. If financial information was entered, contact your bank or payment provider to secure your accounts. Finally, scan your device for malware using updated security software to ensure no additional compromise has occurred. Users should also report the domain to their organization’s IT security team or relevant authorities to aid in broader threat mitigation efforts.