media-support[.]busines-help-center[.]com

This domain, media-support.busines-help-center.com, is actively engaged in credential theft operations targeting users of Meta’s Accounts Centre. Analysis indicates the infrastructure mimics legitimate Meta login portals, presenting a high-fidelity replica of the Accounts Centre interface to harvest user credentials. No direct evidence of crypto drainer functionality was observed, but the domain’s focus on credential capture aligns with broader adversary tactics to enable subsequent account takeovers or financial fraud. Infrastructure analysis reveals the domain was registered on May 21, 2026, through Gransy, s.r.o., a registrar frequently associated with malicious activity. It resolves to the IP address 172.66.0.96, which is proxied through Cloudflare, a common evasion technique to obscure hosting origins. The domain is flagged by 21 out of 95 security vendors on VirusTotal, appears on one security blocklist, and is blocked by at least one enterprise-grade security solution. Technologies detected include Node.js, React, Next.js, and Webpack, suggesting a modern, developer-driven phishing kit designed for scalability and obfuscation. As of the latest assessment, the domain remains active and unmitigated by the registrar or hosting provider. Users are advised to treat any interaction with this domain as hostile and avoid entering credentials or personal information. Organizations should update blocklists to include this domain and its associated IP, while monitoring for related infrastructure leveraging the same registrar or hosting patterns. The elevated risk level persists due to the domain’s operational status and the potential for credential harvesting to facilitate secondary attacks.