lepxwmnsde0eig7urhr1kpfe[.]pages[.]dev

This domain, lepxwmnsde0eig7urhr1kpfe.pages.dev, is actively engaged in brand impersonation targeting Facebook users with the intent to harvest credentials. Analysis confirms the domain is currently operational and classified as high-risk due to its deceptive infrastructure and confirmed malicious activity. Infrastructure analysis reveals the domain was registered on November 20, 2025, through Cloudflare, Inc., and resolves to the IP address 172.253.62.103, associated with Google LLC (AS15169). The SSL certificate is issued by Google Trust Services (WE1), a common pattern observed in phishing campaigns leveraging legitimate cloud providers. The domain appears on one security blocklist and is flagged by 3 of 95 security vendors on VirusTotal, indicating detection by multiple threat intelligence sources. The page title, "Google," further suggests an attempt to mislead users into believing the site is associated with a trusted entity. Current status indicates the domain remains active and poses an ongoing threat to users. Organizations and individuals are advised to block the domain and its associated IP address at the network level. Endpoint protection systems should be updated to include this domain in deny lists, and security teams should monitor for any attempts to access this resource. User awareness training should emphasize the risks of credential submission on untrusted sites, particularly those mimicking social media platforms.