payment-meta[.]program-ads-agency[.]com

This domain is flagged as an active brand impersonation threat targeting Meta, classified at an elevated risk level. The specific threat type involves a fraudulent login portal designed to harvest user credentials under the guise of legitimate Meta services, as indicated by the page title 'Accounts Centre.' Analysis confirms this domain is engineered to deceive users into entering sensitive authentication details, which are then likely exfiltrated for malicious purposes. Infrastructure analysis reveals the following technical indicators: the domain was registered on May 09, 2024, through Gransy, s.r.o., and currently resolves to the IP address 172.66.0.96. It is detected by 20 out of 95 security vendors on VirusTotal, appears on one security blocklist, and holds a Gridinsoft trust score of 0/100. Detected technologies include Node.js, React, Next.js, Cloudflare, Webpack, and HTTP/3, suggesting a modern, obfuscated infrastructure designed to evade detection and enhance persistence. The domain is currently blocked by PhishDestroy, further validating its malicious classification. Mitigation steps specific to this brand impersonation threat include immediate blocking of the domain and its associated IP (172.66.0.96) at the network perimeter. Security teams should deploy indicators of compromise (IOCs) across endpoint detection and response (EDR) systems, web proxies, and email security gateways to prevent user interaction. User awareness training should emphasize the risks of credential submission on unverified login portals, particularly those mimicking Meta's branding. Monitoring for lateral movement or unauthorized access attempts using harvested credentials is critical, as is enforcing multi-factor authentication (MFA) to mitigate the impact of potential credential theft.