cnvmp3-fb[.]pages[.]dev

Analysis of the domain cnvmp3-fb.pages.dev indicates it is an active phishing infrastructure targeting Facebook credentials, as of July 29, 2026. The domain is hosted under Cloudflare Pages (pages.dev), a platform frequently exploited for rapid phishing deployment due to its free tier and automatic SSL. It resolves to the Cloudflare Anycast IP 188.114.97.3, a common address for legitimate and malicious sites alike, making IP-based blocking less effective without additional context. Nameservers hugh.ns.cloudflare.com and leanna.ns.cloudflare.com confirm Cloudflare, Inc. as the registrar and DNS provider, consistent with the hosting origin.

Two of 91 security vendors on VirusTotal have flagged this domain, a modest detection rate that suggests either early-stage abuse or evasion of broader scrutiny. The domain appears on one security blocklist, specifically PhishDestroy, which specializes in credential phishing detection. No additional blocklist presence, Safe Browsing alerts, or Open Threat Exchange (OTX) pulses were identified in the available data, limiting visibility into historical abuse patterns. The exact content and phishing kit in use remain unconfirmed, as no page title, brand target, or scam type beyond 'generic phishing' was provided.

However, the inclusion of 'fb' in the subdomain strongly suggests a Facebook-themed lure, a common tactic for harvesting social media credentials. Defenders should treat this domain as high-risk for credential theft, particularly in environments where Facebook access is relevant. Recommended actions include blocking the domain at DNS and web proxy layers, monitoring for connections to 188.114.97.3 in logs, and alerting users to avoid interaction. Further analysis of the page content and kit fingerprinting would clarify the specific phishing mechanics, but the current evidence supports immediate containment.