advertisers-client-support-guideline-messenger[.]pages[.]dev

This domain was identified as a credential-harvesting phishing portal targeting users through deceptive client support messaging. The site impersonated legitimate advertiser support channels to trick victims into entering login credentials, payment details, or other sensitive information. Such portals often employ urgency tactics, fake alerts, or spoofed login forms to exploit user trust in official communication channels. Analysis indicates the domain was registered on October 14, 2025, through a widely used content delivery network provider. It resolved to the IP address 188.114.96.3, associated with autonomous system AS13335. Security vendors on VirusTotal flagged the domain, with 17 out of 95 engines detecting malicious activity. The site appeared on two security blocklists and was proactively blocked by multiple threat intelligence platforms. The SSL certificate, issued by Google Trust Services, used the WE1 intermediate, a common configuration that does not inherently indicate legitimacy. Users who visited this domain should assume their credentials or entered data were compromised. Immediately reset passwords for any accounts accessed after visiting the site, particularly those related to advertising platforms, financial services, or email. Enable multi-factor authentication on all critical accounts to mitigate unauthorized access. Monitor financial statements and account activity for signs of fraudulent transactions. If personal or payment information was submitted, consider placing a fraud alert with credit bureaus. Report the incident to relevant security teams or incident response channels for further investigation.