lfkap3dchtmarxujai0nolb4[.]pages[.]dev

The domain lfkap3dchtmarxujai0nolb4.pages.dev is flagged for high-risk brand impersonation of Facebook. This domain is part of an ongoing threat campaign designed to deceive users into believing they are interacting with legitimate Facebook services, potentially leading to credential theft or other malicious activities. The threat type is classified as brand impersonation, and there is no indication of a drainer kit being used.

Technical analysis reveals that the domain has been flagged by 3 out of 95 security vendors on VirusTotal, indicating a moderate level of detection. The domain is registered through Cloudflare, Inc., and resolves to the IP address 172.253.62.106, which is located in the United States and belongs to AS15169 Google LLC. The SSL certificate is issued by Google Trust Services / WE1, adding a layer of trust that can be exploited by attackers. The domain was created on November 20, 2025, and is currently listed on 1 security blocklist. It has a Google Safe Browsing (GSB) status that is not explicitly mentioned, but the presence on a blocklist suggests it is considered unsafe.

The current status of the domain is active, and it remains a significant threat. Security teams are advised to implement DNS filtering and URL blocking to prevent access to this domain. Users should be educated to recognize and avoid such impersonation attempts by verifying the URL and using official Facebook channels for login and communication. Despite being flagged by some security vendors, the domain's use of a reputable SSL certificate and hosting infrastructure may still lead to successful attacks if not properly mitigated.