skqa-rxlt-biz26-hnps-vksa-sp1ct[.]pages[.]dev

This domain, skqa-rxlt-biz26.pages.dev, presents a high-risk credential harvesting threat by impersonating Facebook's login interface. Visitors to the site are presented with a page titled 'Facebook – log in or sign up,' designed to deceive users into entering their account credentials. The site does not provide legitimate access to Facebook services and instead captures submitted login details for unauthorized use, including account takeovers or further malicious activities such as spam or financial fraud. Analysis indicates the domain was registered through Cloudflare, Inc. on March 09, 2026, and currently resolves to the IP address 157.240.253.35, located in the United States under AS13335 (Cloudflare, Inc.). The SSL certificate is issued by Google Trust Services (WE1). Security vendors on VirusTotal flagged this domain as malicious, with 18 out of 95 engines detecting it as harmful. The domain appears on one security blocklist and is currently offline, though its infrastructure remains a documented threat. If you visited skqa-rxlt-biz26.pages.dev and entered your Facebook credentials, immediate action is required. First, change your Facebook password using a secure device and enable two-factor authentication if not already active. Review recent login activity on your account for any unauthorized sessions and revoke access to unfamiliar devices or applications. Monitor linked accounts, such as email or financial services, for suspicious activity. Report the incident to Facebook’s support team and consider notifying relevant authorities if sensitive data was compromised. Avoid reusing passwords across multiple platforms to mitigate further risk.