help-verify-20000032[.]pages[.]dev

This domain, help-verify-20000032.pages.dev, is identified as a credential theft operation designed to harvest user login credentials under the guise of a Meta Verified rewards program. The page title, 'Meta Verified - Rewards for you,' explicitly mimics official Meta branding to deceive users into entering sensitive account information. Analysis indicates the site employs social engineering tactics, leveraging the trust associated with Meta's verification services to trick victims into divulging usernames, passwords, and potentially multi-factor authentication codes. The threat extends beyond immediate account compromise, as stolen credentials may be used for follow-on attacks, including financial fraud or further phishing campaigns targeting connected services. Infrastructure analysis reveals multiple red flags corroborating the malicious nature of this domain. The domain was registered on June 10, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.44.210. Security vendors on VirusTotal flagged the domain at a rate of 16/95, indicating moderate consensus on its malicious intent. Additionally, the domain appears on one security blocklist, further validating its classification as a threat. The SSL certificate, issued by Google Trust Services, provides a veneer of legitimacy but does not mitigate the underlying risk posed by the credential theft scheme. Users who visited help-verify-20000032.pages.dev or entered credentials on the site should take immediate action to mitigate potential damage. First, reset passwords for any accounts accessed or entered on the site, prioritizing accounts linked to Meta services. Enable multi-factor authentication if not already active, using app-based or hardware tokens rather than SMS-based methods. Monitor accounts for unauthorized activity, including logins from unfamiliar devices or locations. If financial or payment information was entered, contact relevant institutions to report potential fraud and request transaction monitoring. Finally, scan local devices for malware, as credential theft sites may deploy additional payloads to maintain persistence or exfiltrate further data.