orivok-glnar-gv3006bnh-qjygh-9fg016[.]pages[.]dev

This domain is flagged as an active phishing site impersonating Meta for Business login pages. The site presents a fraudulent interface labeled 'Meta for Business | Page Appeal,' designed to deceive users into entering legitimate Facebook or Meta business account credentials. Once submitted, these credentials are captured by threat actors for unauthorized account access, financial fraud, or further phishing campaigns targeting connected users or business assets. The page mimics official Meta branding, including logos, color schemes, and layout, increasing the likelihood of successful deception among business page administrators and social media managers. Analysis indicates the domain currently has zero detections across 95 security engines on VirusTotal, suggesting it is newly deployed or evasive. It is hosted on Cloudflare infrastructure and resolves to the IP address 172.66.45.34, with an SSL certificate issued by Google Trust Services, providing a false sense of legitimacy. Despite the clean scan result, the domain appears on two independent security blocklists, including PhishDestroy and OpenPhish, which have independently identified it as malicious. The registrar is Cloudflare, Inc., and the site remains active at the time of this report. Users who have visited or entered credentials on orivok-glnar-gv3006bnh-qjygh-9fg016.pages.dev should immediately revoke access to any connected sessions via their Meta Business account security settings. Change the account password using a secure device and enable multi-factor authentication if not already active. Review recent login activity for unauthorized access and remove any unrecognized devices or applications. Monitor linked payment methods, ad accounts, and connected business assets for suspicious activity. Report the incident to Meta through official channels and consider notifying any team members or clients who may have been exposed through shared access. Avoid interacting with any links or communications originating from this domain.