customer-support-system-contact-support-unit[.]pages[.]dev

Analysis of the domain customer-support-system-contact-support-unit.pages.dev indicates a high-risk brand impersonation campaign targeting Facebook users. The domain, registered on March 3, 2026, through Cloudflare, Inc., resolves to the IP address 157.240.253.35, which is associated with AS13335 (Cloudflare, Inc.) in the United States. The page title, 'Facebook - Meld je aan of registreer je,' explicitly suggests an attempt to mimic Facebook's login or registration interface, aligning with the identified scam type of brand impersonation. Infrastructure analysis reveals the use of Cloudflare nameservers (armando.ns.cloudflare.com and treasure.ns.cloudflare.com) and technologies such as HSTS and HTTP/3, which are consistent with modern web hosting practices but do not mitigate the malicious intent. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider, which is often exploited by threat actors to lend credibility to phishing domains.

At the time of assessment, the domain returned an HTTP 403 status, indicating it has been taken offline, though it remains flagged by security vendors. Detection data from VirusTotal shows that 10 out of 93 security vendors have flagged this domain, a modest but notable detection rate that underscores its malicious classification. Google Safe Browsing has also classified the domain as engaging in social engineering, further corroborating its fraudulent nature. The domain appears on at least one security blocklist, and it has been blocked by PhishDestroy. Trust scores from Gridinsoft and Scamadviser are both at the lowest possible value (0/100 and 1/100, respectively), reflecting a high level of confidence in its classification as malicious.

Defenders should treat this domain as part of an active phishing campaign targeting Facebook credentials. While the domain is currently offline, historical resolution to 157.240.253.