policy-rule-violation-scanner[.]pages[.]dev

Analysis of policy-rule-violation-scanner.pages.dev shows a newly registered domain (creation date February 21 2026) hosted on Cloudflare’s network (ASN 13335, IP 172.66.47.55, United States). The site presents a page title "Meta for Business | Page Appeal," suggesting a targeted credential‑phishing campaign against Meta accounts. The SSL certificate is issued by Google Trust Services under the WE1 root, indicating a valid TLS configuration despite the malicious intent. HTTP responses return a 403 status, and the domain enforces HSTS and HTTP/3, confirming contemporary security features typical of legitimate services but often abused by threat actors.

Reputation checks reveal that 13 of 95 VirusTotal scanners flag the domain, Gridinsoft assigns a trust score of 0 / 100, and it appears on a single security blocklist. PhishDestroy has already taken the site offline, and the current status is reported as offline. The registrar information lists Cloudflare, Inc., and the domain uses four Cloudflare nameservers (adi.ns.cloudflare.com, igor.ns.cloudflare.com, karl.ns.cloudflare.com, lady.ns.clou).

While the exact phishing page content has not been captured, the combination of a recent registration, low trust scores, multiple vendor detections, and a brand‑specific page title strongly indicates credential‑phishing activity. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑hosting on alternative IPs, and update detection signatures to include the observed SSL issuer and HSTS usage patterns. Ongoing observation of related Cloudflare‑hosted infrastructure is recommended to catch potential re‑use of the same IP range or nameserver set.