varkel-sonvik-biz-denter-halrex-sp7ct12[.]pages[.]dev

This domain is flagged for elevated-risk brand impersonation targeting Facebook users through credential harvesting infrastructure. Analysis indicates the threat actor deployed a lookalike interface designed to capture authentication credentials, as evidenced by the page title 'Facebook - Meld je aan of registreer je' which mimics legitimate Facebook login portals in Dutch-language regions. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain varkel-sonvik-biz-denter-halrex-sp7ct12.pages.dev was registered through Cloudflare on March 03, 2026, with creation timestamp suggesting rapid deployment for phishing operations. It resolves to IP address 157.240.0.35 within Cloudflare's network (AS13335), while maintaining an SSL certificate issued by Google Trust Services (WE1). Security validation shows 17 out of 95 detection engines on VirusTotal flagged this domain as malicious, and it appears on one security blocklist maintained by PhishDestroy. The combination of Dutch-language interface elements and Cloudflare hosting infrastructure creates a plausible facade for credential theft campaigns. Organizations and users should implement specific mitigation measures against this credential harvesting threat. Network administrators should block all connections to 157.240.0.35 and the full domain at firewall level, while monitoring for any attempts to access this infrastructure from internal networks. Security teams should update endpoint protection rules to detect the unique page title pattern and SSL certificate fingerprint associated with this campaign. User education programs should emphasize verification of domain names before entering credentials, particularly for login portals appearing in non-English languages. Given the domain's current offline status, monitoring for reactivation attempts or similar infrastructure patterns using the same Cloudflare hosting and Dutch-language interface elements is recommended.