marketing-account-audit-console[.]pages[.]dev

The domain marketing-account-audit-console.pages.dev was registered on March 03, 2026 through Cloudflare, Inc. and resolves to the IP address 57.144.244.1, which belongs to AS13335 Cloudflare, Inc. in the United States. An SSL certificate issued by Google Trust Services (WE1) protects the site, and the server presents HSTS, Cloudflare, and HTTP/3 headers. When accessed, the HTTP response code is 403, indicating the content is currently inaccessible. The page title returned by the server is "Facebook - Connexion ou inscription," and the domain is classified as a brand‑impersonation scam targeting Facebook.

Google Safe Browsing has flagged the site for social engineering, and PhishDestroy has added it to its blocklist. VirusTotal reports that 15 of 93 security vendors have flagged the domain, reinforcing the malicious assessment. Independent reputation services assign extremely low scores: Gridinsoft rates it 0/100 and Scamadviser 1/100, indicating a near‑certain malicious intent. The domain appears on one additional security blocklist, further confirming its threat profile.

The infrastructure—cloud‑based hosting, a valid SSL certificate, and the use of standard Cloudflare services—suggests the operators are leveraging legitimate services to lend credibility while delivering a fraudulent Facebook login experience. Because the site is already taken offline, immediate mitigation focuses on ensuring that any cached copies or redirects are removed from client environments and that security controls continue to block the domain and its IP. Defenders should update web filtering and DNS sinkhole rules to include marketing-account-audit-console.pages.dev and the associated IP address, monitor for similar Cloudflare‑hosted domains that impersonate Facebook, and educate users about unsolicited login prompts that reference the French phrase "Connexion ou inscription" as a potential lure.