metaameklogin[.]webflow[.]io

PhishDestroy identifies the domain metaameklogin.webflow.io as a credential phishing threat currently active and elevated in risk. This domain impersonates Meta’s login interface, attempting to harvest user credentials under the guise of a legitimate authentication portal.

This domain was flagged by 20 of 95 VirusTotal security vendors and is blocked by OpenPhish. It resolves to IP address 172.64.151.8 and is secured with a Google Trust Services SSL certificate. The domain was created recently and already appears on one security blocklist. Despite its use of a reputable certificate authority, the domain’s inclusion in phishing feeds and low trust metrics among security vendors indicate active malicious intent.

As of the latest analysis, the threat remains active and poses an elevated risk to users. PhishDestroy recommends immediate avoidance of this domain and any associated links. Users who may have entered credentials on this site should change their Meta account passwords immediately and enable two-factor authentication. Organizations are advised to update firewall rules and DNS blocklists to include this domain and IP address. Security teams should monitor for any signs of credential misuse linked to this phishing campaign.