enabled-meta[.]accounts-admin-agency[.]com

PhishDestroy identifies the domain enabled-meta.accounts-admin-agency.com as an active credential phishing campaign targeting meta platform users. The threat is elevated with a specific focus on harvesting account credentials through spoofed administrative portals. This is not generic phishing but a targeted social engineering attack designed to trick victims into surrendering login details under the guise of account verification or security maintenance. This domain was flagged by 2 out of 95 VirusTotal security vendors on submission, indicating limited but notable detection. Registered through Gransy, s.r.o., it resolves to IP address 162.159.140.98 and operates under a Google Trust Services SSL certificate issued to ‘Google LLC’ — a tactic often used to appear legitimate. Domain creation date is May 01, 2026, a suspiciously forward-dated registration that suggests preemptive abuse. At this time, no public blocklists report the domain, but early detection metrics from VirusTotal suggest emerging malicious activity. The unusually future creation date may be an attempt to evade current monitoring tools that focus on recent registrations. Users should avoid interacting with any unsolicited messages or links referencing this domain, especially those claiming to be from ‘Meta Admin’ or ‘Account Security.’ If credentials were entered, immediately change passwords on all accounts using the same or similar passwords, enable two-factor authentication, and scan devices for malware. Report the domain to your email provider and security teams. Organizations should block the domain and IP at the network level and educate users on recognizing spoofed administrative domains. The early-stage nature of detections (2/95) means traditional defenses may not yet recognize this threat, requiring heightened vigilance and proactive blocking based on IOCs.