websitestealer[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat targeting Facebook users. Analysis indicates the site is designed to mimic legitimate Facebook login or account management portals, likely to harvest credentials or distribute malicious payloads under the guise of official branding. The threat type is classified as brand impersonation, a technique commonly used to exploit user trust in recognized platforms for fraudulent activities. Infrastructure analysis reveals the domain websitestealer.pages.dev was registered through Cloudflare, Inc. on October 16, 2025, and resolves to the IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335). The SSL certificate is issued by Google Trust Services (WE1), a common practice for both legitimate and malicious sites leveraging free certificate authorities. VirusTotal detection shows 8 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist, specifically PhishDestroy. The page title, 'websitecloner,' suggests functionality related to site duplication, which aligns with tactics used to replicate legitimate login pages for phishing campaigns. Mitigation steps for this threat type include immediate blocking of the domain and its associated IP address (188.114.97.3) at the network perimeter. Organizations should update endpoint protection rules to detect and prevent access to websitestealer.pages.dev, particularly for users who may encounter the site through phishing emails or malicious advertisements. Security teams are advised to monitor for credential harvesting attempts linked to this domain and conduct internal awareness campaigns to educate users on identifying brand impersonation tactics. Given the domain’s active status and Cloudflare hosting, additional scrutiny of similar *.pages.dev subdomains is recommended to preemptively identify related threats.