meta-support-subject[.]pages[.]dev

This domain, meta-support-subject.pages.dev, is identified as a phishing infrastructure impersonating Meta (formerly Facebook) support services. Analysis indicates the site was designed to harvest user credentials or sensitive account information through deceptive login portals, a common tactic in credential phishing campaigns. No specific drainer kit signatures were detected in initial scans, though the domain follows patterns consistent with generic phishing frameworks targeting social media platforms. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 172.66.47.153, hosted on AS13335 (Cloudflare, Inc.) with a US-based geolocation. The SSL certificate is issued by Google Trust Services (WE1), and the domain was registered through Cloudflare on September 19, 2025. VirusTotal detection metrics show 18 out of 95 security vendors flagging the domain as malicious. The domain appears on two independent security blocklists, and its page title was automatically set to 'Suspected phishing site | Cloudflare,' indicating automated detection by the hosting provider. Google Safe Browsing (GSB) status was not explicitly provided but is presumed to have been active given the takedown. Current status shows the domain has been taken offline, likely due to enforcement actions by the hosting provider or security teams. While no longer active, the infrastructure remains a residual risk due to potential reuse of the IP or SSL certificate in future campaigns. Users who may have interacted with the domain are advised to reset credentials for any accounts accessed during the exposure window and enable multi-factor authentication where available. Organizations should monitor for related domains using the same IP range or registration patterns, as threat actors frequently rotate infrastructure to evade detection.