business-for-advertisers-impersonation-strike[.]pages[.]dev

The domain business-for-advertisers-impersonation-strike.pages.dev was registered on March 03, 2026 through Cloudflare, Inc. and resolves to the Cloudflare‑provided address 57.144.244.1 (AS13335, United States). DNS is served by cleo.ns.cloudflare.com and zita.ns.cloudflare.com. The site presents an HTTPS certificate issued by Google Trust Services under the WE1 root, indicating a valid TLS handshake despite the malicious intent. HTTP response returned a 403 status code, and the page title captured is "Facebook – Anmelden oder Registrieren," directly referencing the Facebook brand.

Google Safe Browsing flags the domain for social engineering, and it appears on one security blocklist as well as being blocked by PhishDestroy. Reputation services assign extremely low scores: Scamadviser 1/100 and Gridinsoft 0/100. VirusTotal analysis recorded 18 detections out of 93 scanning engines, reinforcing the malicious classification. The observed technologies include HSTS enforcement and HTTP/3 support, typical of Cloudflare‑hosted services.

The intelligence indicates a classic brand‑impersonation campaign targeting Facebook users, likely aiming to harvest credentials or drive fraudulent traffic. The domain is currently taken offline, limiting immediate exposure, but the infrastructure—public Cloudflare IP, low‑trust registrant, and repeated use of a Facebook‑related page title—suggests a reusable template that could be redeployed under a different subdomain. Defenders should add the fully qualified domain to blocklists, monitor for future registrations sharing the same Cloudflare nameservers or IP range, and enforce strict outbound filtering for traffic to Cloudflare‑hosted domains that resolve to low‑reputation URLs. Continuous threat‑intel feeds should be consulted for any resurgence of similar impersonation patterns targeting the Facebook brand.