kelmor-biz-zantix-17126[.]pages[.]dev

Analysis of kelmor-biz-zantix-17126.pages.dev indicates a brand‑impersonation campaign targeting Facebook. The domain was registered on March 03 2026 through Cloudflare, Inc., and resolves to IP 157.240.0.35, which belongs to AS13335 Cloudflare, Inc. in the United States. The site served an HTTP 403 response and presented the page title “Facebook – Anmelden oder Registrieren,” matching the declared brand target. The TLS certificate is issued by Google Trust Services under the WE1 designation, confirming the use of a legitimate certificate chain but not implying benign intent.

Infrastructure analysis shows the domain is protected by Cloudflare’s edge services, with HSTS and HTTP/3 enabled, a common pattern for malicious actors seeking to hide origin servers. Reputation signals are strongly negative: Scamadviser assigns a trust score of 1 / 100, Gridinsoft reports 0 / 100, and the domain appears on a single security blocklist. VirusTotal scans returned nine positive detections out of ninety‑three scanners, and PhishDestroy has listed the domain as blocked. The combination of low trust scores, multiple vendor detections, and blocklist presence suggests a high likelihood of phishing activity despite the current offline status.

Uncertainties remain regarding the exact payload or credential‑harvesting mechanism because the site is no longer reachable and no visual content has been captured. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑hosting attempts on the same IP range, and add the domain to internal threat‑intel feeds. Ongoing observation of Cloudflare‑associated IP blocks and rapid sharing of any new indicators will help mitigate potential re‑use of this infrastructure.