meta-id17641[.]program-ads-agency[.]com

This domain, meta-id17641.program-ads-agency.com, operates as a credential harvesting site specifically targeting Facebook users. The page title 'Accounts Centre' mimics Facebook's authentication interface, tricking users into entering login credentials. Analysis indicates the infrastructure is designed to capture and exfiltrate sensitive account details, likely for subsequent unauthorized access or identity theft operations. The use of a legitimate-sounding subdomain and familiar branding increases the likelihood of successful deception, particularly among users accustomed to Facebook's login workflows.

Infrastructure analysis reveals multiple technical indicators supporting the malicious classification. The domain is flagged by 19 out of 95 security vendors on VirusTotal, with detection labels including 'phishing' and 'fraudulent site.' It appears on one security blocklist and resolves to the IP address 172.66.0.96, hosted behind Cloudflare's network in Canada. The domain was registered on April 17, 2026, through Gransy, s.r.o., a registrar frequently associated with high-risk domains. The SSL certificate, issued by Google Trust Services (WE1), provides a false sense of security while failing to validate the site's legitimacy.

Users who have visited meta-id17641.program-ads-agency.com should immediately cease all interaction and assume their credentials may be compromised. Those who entered login details should change their Facebook password using a separate, trusted device and enable multi-factor authentication. Monitor account activity for unauthorized logins or posts, and report the incident to the platform's abuse team. Browser-based password managers should be reviewed for any stored credentials associated with the domain. Network administrators are advised to block the domain and its resolving IP at the perimeter to prevent further exposure.