business-for-advertisers-support-demonetization[.]pages[.]dev

The domain business-for-advertisers-support-demonetization.pages.dev was identified as an elevated-risk brand impersonation threat targeting Facebook users. Analysis confirms the domain was designed for credential theft, mimicking Facebook’s login interface with the page title 'Facebook - log in or sign up.' The domain is currently offline, though prior activity suggests it was actively used in malicious campaigns. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., and resolved to the IP address 31.13.66.35. It was flagged by 12 of 95 security vendors on VirusTotal, indicating broad detection as malicious. The domain was created on March 03, 2026, and appeared on one security blocklist. The SSL certificate was issued by Google Trust Services (WE1), a detail often exploited to lend legitimacy to phishing pages. The combination of Facebook branding, a login-themed page title, and low initial detection rates suggests an attempt to evade automated defenses. While the domain is currently offline, its prior use in credential theft campaigns warrants continued monitoring. Organizations and users are advised to block the domain and IP address at the network level. Security teams should review logs for connections to 31.13.66.35 or visits to business-for-advertisers-support-demonetization.pages.dev, particularly from users who may have entered credentials. Multi-factor authentication (MFA) should be enforced for all accounts to mitigate the impact of potential credential exposure. Additionally, user awareness training should emphasize the risks of brand impersonation and the importance of verifying domain authenticity before entering login details.