ebony-shares-faqs-apparent[.]trycloudflare[.]com

Analysis of the domain ebony-shares-faqs-apparent.trycloudflare.com indicates it is a confirmed Facebook brand impersonation site, classified as a social media phishing threat. The domain was registered on February 21, 2026, and is hosted on Cloudflare's infrastructure (AS13335) via a Cloudflare Tunnel, resolving to the IPv6 address 2606:4700::6810:e684. The SSL certificate is issued by WE1, a Cloudflare-managed certificate authority. The page title, 'Facebook – Log in or Sign up,' directly matches Facebook's official login page, reinforcing its impersonation intent.

As of July 23, 2026, the domain is offline and appears on at least one security blocklist (PhishDestroy). Detection engines on VirusTotal flagged the domain, with 15 of 93 vendors marking it as malicious. Trust scores from Gridinsoft and Scamadviser are 0/100 and 1/100, respectively, further supporting its classification as a high-risk phishing domain. Defenders should treat this domain as a confirmed threat, block it at the network level, and monitor for related infrastructure reuse.

The use of Cloudflare Tunnel suggests the attacker may have leveraged legitimate services to evade detection, a tactic increasingly observed in phishing campaigns. No additional scam categorization (e.g., credential harvesting, malware distribution) is confirmed beyond the provided 'social media phishing' classification. The exact content and functionality of the site remain unanalyzed, but the available indicators align with known Facebook phishing patterns.