proj-482697-jt5o[.]pages[.]dev

The domain proj-482697-jt5o.pages.dev is currently under investigation for brand impersonation targeting Facebook, specifically designed for credential theft. Analysis confirms the page title as 'Bei Facebook anmelden,' directly mimicking Facebook's German-language login interface to deceive users into submitting authentication credentials. The domain remains active as of the latest verification. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on May 26, 2025, and resolves to the IP address 157.240.0.35, geolocated in Germany under AS32934 (Facebook, Inc.). Despite its association with Facebook's autonomous system, the domain has not been flagged by any of the 95 security vendors on VirusTotal. It appears on a single security blocklist, indicating limited detection coverage. The SSL certificate is issued by Google Trust Services (WE1), providing a veneer of legitimacy while the underlying infrastructure supports malicious activity. Current status shows the domain remains operational, posing an ongoing risk to users. Organizations and individuals are advised to block access to proj-482697-jt5o.pages.dev at the network level and implement multi-factor authentication to mitigate credential theft risks. Security teams should monitor for similar subdomains under the pages.dev namespace, particularly those impersonating login portals. Users encountering this domain should avoid entering credentials and report the incident to their security providers for further analysis.