sarvo-rixan-biz-paxru-zxgt22526r-pravix[.]pages[.]dev

The domain sarvo-rixan-biz-paxru-zxgt22526r-pravix.pages.dev was created on March 03, 2026 and is presently taken offline. Infrastructure analysis shows the domain resolves to IP address 157.240.0.35, which is owned by Cloudflare, Inc. (ASN13335) and located in the United States. Both authoritative nameservers, brady.ns.cloudflare.com and ximena.ns.cloudflare.com, are Cloudflare‑operated, confirming that the hosting provider is the same service used for the target brand’s legitimate traffic. The site presented an HTTPS endpoint secured by a Let’s Encrypt certificate (issuer E8) and employed security headers such as HTTP Strict Transport Security (HSTS) and HTTP/3, all typical of Cloudflare‑protected sites. An HTTP request returned status code 403, indicating that the server is refusing access, which aligns with the reported offline status.

Brand‑targeting evidence consists of the page title "Facebook – log in or sign up" and the classification of the campaign as a Brand Impersonation aimed at Facebook. Trust scoring services reflect extreme distrust: Scamadviser assigned a score of 1 / 100 and Gridinsoft a score of 0 / 100. The domain appears on one security blocklist and has been actively blocked by PhishDestroy. VirusTotal analysis recorded 10 detections out of 93 scanning engines, reinforcing the malicious assessment.

Current gaps include the lack of a content‑level review of the landing page because the site is no longer reachable. Consequently, the exact phishing kit or credential‑harvesting mechanisms cannot be confirmed. Defenders should continue to block the domain at network perimeter, update DNS sinkhole lists, and monitor for any re‑registration attempts. Given the confirmed use of Facebook branding in the page title and the presence on multiple threat‑intel feeds, the domain should be treated as an elevated‑risk impersonation vector until further forensic evidence becomes available.