proj-886674-fpza[.]pages[.]dev

This domain is flagged as a high-risk credential theft operation specifically designed to impersonate Facebook. Analysis indicates the site presents a fraudulent login interface, mirroring Facebook's legitimate authentication portal to harvest user credentials. The threat type is narrowly classified as brand impersonation with credential theft intent, rather than generic phishing or broader fraud schemes. Infrastructure analysis reveals multiple concerning indicators. The domain proj-886674-fpza.pages.dev was registered on May 26, 2025, through Cloudflare, Inc., and currently resolves to the IP address 31.13.66.35, which is associated with Facebook, Inc. (AS32934) in the United States. Only 1 out of 95 security vendors on VirusTotal has flagged this domain, suggesting either recent deployment or evasion techniques. The domain appears on one security blocklist and is actively blocked by at least one threat intelligence feed. The SSL certificate is issued by Google Trust Services (WE1), and the page title explicitly mimics Facebook's login page, further confirming its impersonation intent. Mitigation steps for this specific threat type include immediate blocking of the domain and IP at network perimeter controls. Organizations should implement strict certificate validation to detect mismatched or suspicious SSL issuers, particularly when domains claim affiliation with major brands. User education should emphasize verifying domain authenticity before entering credentials, especially for login pages that appear unexpectedly or via unsolicited links. Security teams are advised to monitor for failed login attempts or unusual authentication patterns originating from internal networks, as these may indicate compromised credentials from this campaign. Given the domain's recent creation and low detection rate, proactive hunting for related infrastructure or similar naming patterns is recommended.