policy-compliance-office[.]pages[.]dev

The domain policy-compliance-office.pages.dev was registered through Cloudflare on 3 March 2026 and resolves to the Cloudflare‑owned address 57.144.244.1, ASN 13335, located in the United States. The site served a page whose title reads “Facebook – log in or sign up”, indicating an attempt to masquerade as the Facebook login portal. The SSL certificate presented is issued by Google Trust Services under the WE1 CA, which is a legitimate certificate authority but does not authenticate the underlying brand. HTTP responses return a 403 status code, and the server advertises HSTS, HTTP/3, and Cloudflare security headers.

Reputation services rate the domain extremely poorly: Gridinsoft assigns a trust score of 0 out of 100, Scamadviser a score of 1 out of 100, and the domain appears on a single external blocklist. VirusTotal analysis shows that 11 of 93 scanned scanners flagged the domain as malicious, and PhishDestroy has already added it to its blocklist. The infrastructure is typical of Cloudflare‑based abuse, using the nameservers rosemary.ns.cloudflare.com and sam.ns.cloudflare.com. No further content has been captured because the site is currently offline.

The evidence confirms a brand‑impersonation campaign targeting Facebook users. Defenders should continue to block the domain at the network perimeter, monitor DNS queries for the associated IP and nameservers, and add the domain to internal phishing watchlists. Additional investigation should focus on any associated subdomains or similar “pages.dev” hosts that share the same Cloudflare account, as the registration details provide little attribution beyond the registrar.