members69[.]partner-invite-business[.]com

This domain, members69.partner-invite-business.com, is flagged for brand impersonation targeting Facebook, specifically mimicking the Meta Business Help Centre. Analysis indicates the threat type aligns with credential harvesting campaigns, likely designed to deceive users into submitting login credentials under the guise of official Meta support. No explicit drainer kit signatures were identified in preliminary scans, though the infrastructure exhibits characteristics consistent with phishing-as-a-service frameworks. Infrastructure analysis reveals the domain resolves to the IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335) in the United States. It was registered on February 21, 2026, through Gransy, s.r.o., a registrar frequently observed in transient phishing operations. The SSL certificate, issued by Google Trust Services (WE1), provides a veneer of legitimacy but does not mitigate the underlying threat. Detection metrics show 20 out of 95 security vendors flagging the domain on VirusTotal, with a single entry on a security blocklist. Google Safe Browsing (GSB) does not currently list the domain, though this may reflect a lag in propagation rather than an absence of risk. As of the latest assessment, the domain has been taken offline, likely in response to automated takedown requests or registrar intervention. However, the elevated risk level persists due to the domain’s recent creation and the registrar’s history of hosting ephemeral phishing infrastructure. Organizations are advised to monitor for residual redirects or cached pages, particularly in environments where users may have interacted with the domain prior to its deactivation. Proactive measures include blocking the IP 188.114.97.3 at the network perimeter and updating endpoint detection rules to account for variations of the Meta Business Help Centre impersonation theme.