ad-account-event-tracking-center[.]pages[.]dev

This domain, ad-account-event-tracking-center.pages.dev, is identified as a high-risk credential phishing site specifically targeting Facebook users. Analysis indicates the site employs brand impersonation techniques, replicating the Facebook login interface with the page title 'Facebook – log in or sign up.' The domain is designed to harvest user credentials by deceiving victims into entering their account details on a fraudulent platform. Technical indicators confirm the malicious nature of this infrastructure. The domain was registered on March 3, 2026, through Cloudflare, Inc., and resolves to the IP address 57.144.186.1, hosted on Cloudflare’s network (AS13335). VirusTotal detection rates show 13 out of 95 security vendors flagging the domain as malicious. Google Safe Browsing explicitly classifies it as a phishing site, and it appears on at least one security blocklist. The SSL certificate is issued by Google Trust Services, using the identifier WE1, which may add a veneer of legitimacy to unsuspecting users. As of the latest assessment, the domain has been taken offline, likely due to detection and subsequent mitigation efforts. However, the infrastructure remains a residual risk, as threat actors may repurpose or rehost the phishing kit on alternative domains. Users who may have interacted with this domain should immediately reset their Facebook credentials and enable multi-factor authentication. Organizations are advised to block the domain and associated IP addresses at the network level and monitor for similar impersonation attempts targeting social media platforms.