meta-id90003[.]agency-manager-support[.]com

This domain is flagged for hosting a fake login portal designed to harvest user credentials. Analysis indicates the infrastructure impersonates legitimate account management interfaces, as evidenced by the page title 'Accounts Centre,' a common branding element used in credential theft campaigns. The threat type aligns with brand impersonation tactics, where attackers mimic trusted platforms to deceive users into submitting sensitive information. Infrastructure analysis reveals the domain meta-id90003.agency-manager-support.com was registered on May 07, 2026, through Gransy, s.r.o., a registrar frequently associated with high-risk domains. It resolves to IP address 172.66.0.96, hosted on Cloudflare infrastructure in Canada, which is often leveraged to obfuscate malicious origins. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider, but this does not mitigate the domain's malicious intent. VirusTotal detections show 20 out of 95 security vendors flagging the domain as malicious. Additionally, the domain appears on one security blocklist and is actively blocked by at least one threat intelligence feed. To mitigate risks associated with this fake login portal, organizations and users should immediately block access to the domain and its resolving IP address (172.66.0.96) at the network perimeter. Endpoint protection solutions should be updated to include this domain in deny lists, and security teams should monitor for any attempts to access it. Users who may have interacted with the portal should be instructed to reset credentials on any accounts accessed during the exposure window, particularly if the same passwords were reused across multiple services. Network logs should be reviewed for connections to the domain or IP to identify potential compromised accounts.