movino-biz-larqax-29126[.]pages[.]dev

Analysis of movino-biz-larqax-29126.pages.dev indicates that the domain is being used for a brand‑impersonation campaign targeting Facebook users. The site presents the page title "Facebook – log in or sign up," which directly mirrors the legitimate Facebook login prompt. Technical inspection shows the domain is hosted on Cloudflare and resolves to IP 157.240.8.35, an address owned by AS13335 Cloudflare, Inc., located in the United States. HSTS and HTTP/3 are enabled, and the TLS certificate is issued by Google Trust Services under the WE1 identifier, suggesting the use of a valid certificate to increase perceived legitimacy.

The domain was registered on March 03, 2026 through Cloudflare, Inc., and uses the nameservers art.ns.cloudflare.com and katja.ns.cloudflare.com. Security scanners have flagged the domain: VirusTotal reports 15 detections out of 93 vendors, and it appears on at least one public blocklist (PhishDestroy). Reputation services assign extremely low trust scores, with Scamadviser rating 1/100 and Gridinsoft 0/100. An HTTP request returns a 403 status, which may indicate that the content is no longer publicly accessible, and the current status is recorded as offline.

While the site is presently taken down, the infrastructure—particularly the use of a legitimate Cloudflare front‑end and a valid SSL certificate—demonstrates a level of operational sophistication designed to evade casual inspection. Defenders should continue to block the domain at network perimeter devices, monitor for any resurgence of the same host or associated IP ranges, and update URL filtering rules to include the full domain. Incident response teams should also consider augmenting user awareness campaigns that reference the exact page title and the brand‑impersonation tactic, ensuring that end‑users recognize attempts to harvest Facebook credentials from look‑alike URLs.