llonex-fursa-a7c109-wplm[.]pages[.]dev

This domain, llonex-fursa-a7c109-wplm.pages.dev, is identified as a high-risk phishing site targeting users of Facebook Business services. Analysis of the page title, 'Meta for Business | Page Appeal,' indicates an attempt to impersonate legitimate Meta (Facebook) business verification or appeal portals, a common tactic in credential harvesting campaigns. The site likely employs a phishing kit designed to mimic Meta’s branding, including logos, login forms, and business verification workflows, to deceive victims into submitting sensitive credentials or financial information. Infrastructure analysis reveals several critical technical indicators. The domain resolves to the IP address 172.66.44.108, hosted under Cloudflare’s infrastructure, and is registered through Cloudflare, Inc. The SSL certificate is issued by Google Trust Services, which, while legitimate, is frequently exploited by threat actors to lend credibility to malicious sites. As of the latest assessment, the domain is flagged by 6 out of 95 security vendors on VirusTotal, including detections for generic phishing and social engineering. It appears on two security blocklists, including PhishDestroy and OpenPhish, and remains unlisted in Google Safe Browsing. No creation date is publicly available, but the domain’s structure and naming convention suggest recent deployment, consistent with short-lived phishing campaigns. The domain remains active and poses a significant risk to users, particularly those managing business accounts on Facebook. Current response actions include its inclusion on multiple blocklists, but the site continues to resolve and may still be accessible to unsuspecting victims. Organizations and individuals are advised to block the domain and IP at the network level, and to implement additional verification steps for any unexpected Meta Business-related communications. Users who may have interacted with this domain should immediately reset their credentials and enable multi-factor authentication on all associated accounts. Given the high-risk classification and active status, continued monitoring for related infrastructure or similar domains is recommended.