meta-trustline[.]pages[.]dev

This domain, meta-trustline.pages.dev, operates as a fraudulent cryptocurrency login portal designed to harvest credentials and drain digital wallets. Analysis indicates the site mimics legitimate Meta (formerly Facebook) trust verification pages, presenting users with fake authentication prompts to steal login details and private keys. The threat primarily targets users of decentralized applications and cryptocurrency platforms, leveraging social engineering tactics to exploit trust in the Meta brand. Visitors who input sensitive information risk immediate unauthorized access to their accounts and funds, with potential for secondary attacks such as malware distribution or further phishing campaigns. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on October 11, 2025, through Cloudflare, Inc., a registrar frequently abused for phishing operations due to its free hosting and privacy protections. It resolves to the IP address 172.66.47.26, associated with Cloudflare's Anycast network (AS13335), which obscures the true origin of the attack. Detection systems show 17 out of 95 security vendors flagging the domain as malicious, including confirmed listings on two specialized phishing blocklists. The SSL certificate, issued by Google Trust Services (WE1), provides a false sense of security while failing to validate the site's legitimacy. Google Safe Browsing and independent threat intelligence platforms have classified this as a confirmed phishing threat. Users who visited meta-trustline.pages.dev or entered credentials on the site should take immediate action to mitigate risks. First, revoke any active sessions or connected applications from the affected account and change passwords for all linked services. Enable multi-factor authentication using hardware-based or app-based tokens, avoiding SMS-based verification. Monitor financial accounts and blockchain transactions for unauthorized activity, and consider transferring assets to a new wallet if cryptocurrency exposure is suspected. Report the incident to relevant platforms and local cybersecurity authorities to contribute to threat intelligence sharing. Forensic analysis of the device used to access the site is recommended to check for secondary infections or data exfiltration.