bcsa-ptxr-biz4-hkvn-rqla-sp2ct[.]pages[.]dev

This domain is flagged as an elevated-risk brand impersonation threat targeting Facebook users. Analysis indicates the infrastructure is designed to deceive victims through a fraudulent Meta for Business "Page Appeal" interface, likely intended to harvest login credentials or propagate further social engineering attacks. The specific threat type, brand impersonation, leverages the trust associated with the targeted brand to increase the likelihood of successful compromise. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain bcsa-ptxr-biz4-hkvn-rqla-sp2ct.pages.dev resolves to IP address 172.66.47.146, hosted on Cloudflare’s network (AS13335). Security vendors on VirusTotal flagged the domain at a rate of 14/95, while it appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious Cloudflare-hosted domains. The domain was registered on January 31, 2026, through Cloudflare, Inc., and is currently offline. The page title, "Meta for Business | Page Appeal," directly mimics Facebook’s branding to lure victims into interacting with the fraudulent content. Mitigation steps for this specific threat type include immediate domain blacklisting at the network perimeter to prevent access by internal users. Security teams should monitor for credential submission attempts originating from internal IPs, particularly those interacting with known Facebook-related domains. End-user education should emphasize verifying domain authenticity before entering credentials, especially for "appeal" or "account recovery" pages. Additionally, organizations should review logs for connections to 172.66.47.146 or related Cloudflare-hosted domains with similar naming patterns. Given the elevated risk level, security teams are advised to treat any interaction with this domain as a potential compromise and initiate incident response protocols accordingly.