internal-lumtrix-meta-performance-database[.]pages[.]dev

Analysis of the domain internal-lumtrix-meta-performance-database.pages.dev indicates an elevated-risk brand impersonation campaign targeting Facebook users. The domain, registered through Cloudflare, Inc. on March 3, 2026, resolves to IP 57.144.172.1 (AS13335, Cloudflare, Inc., US) and uses Cloudflare nameservers (art.ns.cloudflare.com, brenna.ns.cloudflare.com). The SSL certificate is issued by Google Trust Services (WE1), and the site employs HSTS and HTTP/3 technologies. At the time of assessment, the domain returned an HTTP 403 status, suggesting access restrictions or takedown measures.

Security vendor detections are limited but notable: 10 of 93 vendors on VirusTotal flagged the domain as malicious, and it appears on one security blocklist, with PhishDestroy actively blocking it. Trust scores from Gridinsoft and Scamadviser are both at 0/100 and 1/100, respectively, reinforcing its high-risk classification. The page title, 'Facebook - log in or sign up,' confirms the impersonation intent, aligning with the reported scam type of brand impersonation targeting Facebook. Defenders should treat this domain as a confirmed threat vector.

The use of Cloudflare infrastructure may complicate attribution, but the combination of low trust scores, vendor detections, and the explicit Facebook branding in the page title warrants immediate blocking at the DNS and network levels. While the domain is currently offline, historical resolution data should be reviewed for potential lateral movement or secondary domains associated with the same IP or registrar. Further investigation into the SSL certificate chain and Cloudflare account activity may yield additional indicators of compromise (IOCs) for related campaigns.