ad-account-inspection-hub-6sg[.]pages[.]dev

Analysis of ad-account-inspection-hub-6sg.pages.dev as of July 24, 2026 shows a high-risk brand-impersonation campaign targeting Facebook users. The domain was created on 2026-03-03 and registered through Cloudflare, Inc., using Cloudflare’s default nameservers bruce.ns.cloudflare.com and tara.ns.cloudflare.com. DNS resolution points to IP 157.240.8.35, an address owned by AS13335 Cloudflare, Inc., located in the United States. The site responded with HTTP 403, and the TLS certificate was issued by Google Trust Services under the WE1 root, providing a legitimate‑looking HTTPS façade.

Google Safe Browsing classifies the URL as social engineering, and PhishDestroy has listed it on its blocklist. VirusTotal recorded detections from 16 of 93 scanned security vendors, confirming malicious intent. Independent reputation services assign extremely low trust scores (Scamadviser 1/100, Gridinsoft 0/100), and the domain appears on a single security blocklist. The page title "Facebook – log in or sign up" aligns with the declared impersonation of the Facebook brand.

Detected technologies include HSTS, Cloudflare edge services, and HTTP/3, which are typical for fast‑served malicious pages. The domain is currently offline, limiting immediate observation, and no public samples of the page content are available beyond the title. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑hosting on alternative Cloudflare‑protected subdomains, and update URL‑filtering and endpoint protection signatures to reflect the 16 vendor detections. Ongoing vigilance is advised because the underlying infrastructure—Cloudflare‑provided IP space and generic SSL—can be rapidly reused for new impersonation sites.