advertising-account-scan-control-hub[.]pages[.]dev

The domain advertising-account-scan-control-hub.pages.dev was registered on March 03, 2026 through Cloudflare and uses Cloudflare name servers (rafe.ns.cloudflare.com, stanley.ns.cloudflare.com). It resolves to IP address 157.240.0.35, an address associated with Facebook infrastructure, but the IP is announced by AS13335 Cloudflare, Inc., indicating the site is hosted behind Cloudflare's reverse‑proxy service. The site presented a page title "Facebook – log in or sign up", directly referencing the Facebook brand, and the threat classification in the intelligence set is Brand Impersonation targeting Facebook. Security scanners have flagged the domain: 16 out of 93 VirusTotal vendors report it as malicious, Google Safe Browsing lists it under social engineering, PhishDestroy has blocked it, and it appears on one additional security blocklist.

Reputation services assign extremely low trust scores (Scamadviser 1/100, Gridinsoft 0/100). The site served HTTPS using a Google Trust Services / WE1 certificate, employed HSTS and HTTP/3, and returned an HTTP 403 status before being taken offline. The combination of brand‑specific page title, low trust scores, multiple vendor detections, and blocklist listings provides concrete evidence that the domain was being used for a Facebook impersonation campaign.

Uncertainty remains regarding the exact content served before takedown, as the current HTTP 403 response prevents content inspection, and no phishing kit or payload details are disclosed. Defenders should continue to block the domain at network perimeters, monitor DNS queries for the domain and its subdomains, and add the IP address to deny lists. Organizations should also educate users about unsolicited login prompts referencing Facebook, and employ email and web gateway filters that reference the observed indicators (domain, IP, and Google Safe Browsing classification).