account-trust-center[.]pages[.]dev

Analysis indicates that the domain account-trust-center.pages.dev was registered on March 03, 2026 and is hosted on Cloudflare infrastructure, resolving to IP 157.240.0.35 within AS13335 (Cloudflare, Inc.) located in the United States. The site serves content over HTTPS using a certificate issued by Google Trust Services under the WE1 intermediate, and the connection enforces HTTP Strict Transport Security (HSTS) and supports HTTP/3. The domain is listed on a single security blocklist and is explicitly blocked by PhishDestroy. Reputation services assign extremely low scores: Scamadviser rates the site 1 out of 100, while Gridinsoft assigns 0 out of 100.

VirusTotal analysis shows that 11 of 93 scanned security vendors flagged the domain as malicious, reinforcing the suspicion of abuse. The page title returned by the server is “Facebook - Connexion ou inscription”, matching the claimed brand target of Facebook and consistent with a brand‑impersonation campaign. The HTTP response code is 403, and the site is currently taken offline, limiting immediate interaction but not removing the underlying infrastructure. The combination of a newly created domain, use of a popular brand name in the title, low reputation scores, and multiple vendor detections strongly suggests that the domain was intended to harvest credentials or otherwise lure victims by mimicking Facebook login pages.

However, the exact payload, phishing kit, or capture mechanism cannot be confirmed because the content has not been captured and the site now returns only a 403 status. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any related CNAME or sub‑domain variations pointing to the same IP address, and update threat‑intel feeds with the observed indicators: domain name, IP address 157.240.0.35, nameservers alaric.ns.cloudflare.com and susan.ns.cloudflare.com, and the observed SSL certificate details.