meta-prime-egn[.]pages[.]dev

This domain, meta-prime-egn.pages.dev, poses a targeted credential theft threat by impersonating Meta for Business login portals. Analysis indicates the page title 'Meta for Business | Page Appeal' was designed to deceive users into entering legitimate Meta account credentials, which would then be harvested for unauthorized access to business pages, advertising accounts, or financial information. The threat extends beyond individual compromise, as stolen credentials could facilitate further social engineering attacks or unauthorized ad spend on compromised business accounts. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on September 22, 2025, and currently resolves to the IP address 172.66.44.241 (AS13335, US). The domain appears on 2 security blocklists and is flagged by 19 out of 95 security vendors on VirusTotal. The SSL certificate, issued by Google Trust Services (WE1), provides a false sense of legitimacy while the domain remains offline following takedown actions. The combination of Cloudflare hosting, recent registration, and Meta brand impersonation aligns with known credential harvesting tactics. Users who visited meta-prime-egn.pages.dev or entered credentials on any page resembling Meta for Business should immediately reset their Meta account passwords using a secure device. Enable multi-factor authentication (MFA) via an authenticator app, not SMS, and review recent account activity for unauthorized logins or changes. Business account administrators should audit all connected users, revoke suspicious sessions, and monitor for unusual ad creation or spending patterns. If financial information was entered, contact the associated payment provider to dispute unauthorized transactions and monitor credit reports for signs of identity theft.