member38[.]agency-partner-platform[.]com

Analysis of member38.agency-partner-platform.com shows a credential‑phishing infrastructure that has been taken offline as of the report date, July 24 2026. The domain was registered on November 09 2025 through Gransy, s.r.o., and resolves to the Cloudflare address 172.67.213.130, which is located in the United States (Cloudflare, Inc.). The site employed a modern web stack—Node.js, React, Next.js, Webpack, and HTTP/3—indicating a purpose‑built phishing front end rather than a compromised third‑party site. No TLS certificate was observed, meaning the connection was not protected by HTTPS at the time of capture.

The page title returned "Meta Business Help Centre," suggesting the phishing campaign targeted Meta business users, though the exact page content was not examined. VirusTotal scans flagged the domain in 20 of 94 security vendors, and the domain appears on a single public blocklist, confirming that multiple independent sources consider it malicious. Reputation services assign extremely low trust scores (1/100 on Scamadviser and 0/100 on Gridinsoft), reinforcing the malicious assessment. The domain is listed as blocked by PhishDestroy, and its nameservers—hasslo.ns.cloudflare.com and thea.ns.cloudflare.com—are standard Cloudflare delegations, offering no indication of additional hosting anomalies.

Defenders should continue to block the domain at perimeter filters, update DNS blocklists to include the observed nameservers and IP address, and monitor for any re‑registration attempts. Given the lack of SSL and the presence of a Meta‑related page title, any inbound traffic to this domain should be treated as high‑risk credential harvesting. Continuous monitoring of Cloudflare‑hosted IP ranges for similar patterns is recommended, as the infrastructure could be reused under a different domain.