meta-vista[.]pages[.]dev

This domain, meta-vista.pages.dev, has been identified as a phishing portal specifically designed to impersonate Meta (formerly Facebook) login interfaces. Analysis indicates the site was actively harvesting credentials through fake authentication pages before being taken offline. The threat type is classified as brand impersonation with credential theft objectives, targeting users of social media platforms. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on September 20, 2025, and resolved to the IP address 188.114.97.3, which is geolocated in the United States under AS13335 (Cloudflare, Inc.). At the time of detection, the domain was flagged by 18 of 95 security vendors on VirusTotal, appearing on two distinct security blocklists. The SSL certificate was issued by Google Trust Services (WE1), a common characteristic observed in both legitimate and malicious Cloudflare-hosted domains. The page title, 'Suspected phishing site | Cloudflare,' suggests automated detection by the hosting provider prior to manual review. The domain is currently offline, though historical data indicates elevated risk due to its recent creation, targeted impersonation of a high-value brand, and cross-vendor detection. Organizations and individuals are advised to block the domain and IP at the network perimeter, revoke any credentials potentially exposed through this portal, and monitor for related phishing attempts using similar naming conventions (e.g., meta-[variant].pages.dev). Security teams should prioritize reviewing logs for connections to 188.114.97.3 between September 20 and the takedown date, as this may indicate compromised accounts requiring remediation.