businees-verify-badge-vip-123634[.]pages[.]dev

This domain, businees-verify-badge-vip-123634.pages.dev, is actively engaged in credential theft through brand impersonation, specifically targeting Meta (formerly Facebook) users. The page mimics Meta Verified reward programs, tricking victims into entering login credentials under the guise of exclusive benefits or account verification. The threat leverages social engineering tactics, exploiting trust in the Meta brand to harvest sensitive authentication details, which can lead to account takeovers, unauthorized access to linked services, or further targeted phishing attacks. Analysis indicates the domain was registered through Cloudflare, Inc., and resolves to the IP address 172.66.44.93. It was created on June 16, 2026, though this date may reflect a falsified or manipulated registration record. The domain appears on one security blocklist and is flagged by 17 out of 95 security vendors on VirusTotal, with detections including credential phishing and brand impersonation. The SSL certificate is issued by Google Trust Services, and the site employs HSTS and HTTP/3, which are legitimate security features but are often abused to lend credibility to malicious infrastructure. The page title, 'Meta Verified - Rewards for you,' directly aligns with known Meta-themed phishing campaigns observed in recent months. Users who visited this domain should immediately revoke any entered credentials, particularly for Meta or associated accounts. Enable multi-factor authentication (MFA) on all linked services to mitigate unauthorized access. Monitor accounts for suspicious activity, such as unrecognized logins, password changes, or unauthorized posts. If financial or personal data was submitted, consider placing a fraud alert on credit files and reviewing transaction histories for anomalies. Security teams should block the domain and its resolving IP (172.66.44.93) at the network level to prevent further exposure. Given the elevated risk level, affected users are advised to report the incident to relevant platform abuse teams and local cybersecurity authorities for further investigation.