meta-finale[.]pages[.]dev

This domain, meta-finale.pages.dev, is identified as a credential theft operation targeting users of a major social media platform. The site presents fraudulent login interfaces designed to capture usernames and passwords, which are then likely exploited for account takeovers, unauthorized access to linked services, or further social engineering attacks. Credential theft remains a prevalent threat due to its low technical barrier and high success rate in compromising personal and corporate accounts. Analysis indicates the domain was registered on September 23, 2025, through Cloudflare, Inc., a registrar frequently leveraged by threat actors for its privacy protections and ease of deployment. The domain resolves to the IP address 172.66.47.26, hosted on infrastructure belonging to AS13335 (Cloudflare, Inc.), a common pattern for phishing campaigns seeking to obfuscate their origins. Detection metrics reveal 17 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on two additional security blocklists. The SSL certificate, issued by Google Trust Services (WE1), further confirms the use of legitimate encryption to lend an air of authenticity to the fraudulent site. Users who visited meta-finale.pages.dev should assume their credentials were compromised. Immediate steps include changing passwords for the targeted platform and any accounts sharing the same credentials. Enable multi-factor authentication where available to mitigate unauthorized access. Monitor linked accounts for suspicious activity, such as unauthorized logins or messages sent without consent. If financial or sensitive personal data was entered, consider placing a fraud alert with relevant institutions. Organizations should update their security blocklists to include this domain and its associated IP to prevent future access attempts.