lks-mwd-biz-ukx-jfs-sp2ct2[.]pages[.]dev

Analysis of the domain lks-mwd-biz-ukx-jfs-sp2ct2.pages.dev indicates it was actively impersonating Facebook (Meta) as part of a brand impersonation scheme. The domain, registered on February 21, 2026, through Cloudflare, Inc., resolved to the IP address 188.114.97.3, hosted on Cloudflare's infrastructure (AS13335) in the United States. The page title, 'Meta for Business | Page Appeal,' directly references Meta's business services, reinforcing the impersonation targeting corporate or advertising users of the platform. Infrastructure evidence includes the use of Cloudflare nameservers (adi.ns.cloudflare.com, amy.ns.cloudflare.com, karl.ns.cloudflare.com, tosana.ns.cloudflare.com) and technologies such as HSTS and HTTP/3, which are consistent with legitimate services but frequently leveraged by phishing domains to evade detection.

The domain was flagged by 13 of 93 security vendors on VirusTotal, and it appeared on at least one security blocklist prior to being taken offline. Gridinsoft assigned a trust score of 0/100, further corroborating its malicious classification. The domain's current HTTP status is 403, and it is confirmed offline as of the report date. Defenders should treat this domain as a confirmed brand impersonation threat.

The combination of Meta-related page titles, Cloudflare hosting, and detection by multiple security vendors provides strong technical evidence of malicious intent. While the domain is no longer active, historical DNS and WHOIS records should be preserved for forensic analysis, and any residual references in logs or threat feeds should be blocked. No evidence of a specific phishing kit or additional scam subcategories (e.g., credential harvesting, payment fraud) was present in the available data, so further investigation would be required to determine the full scope of the campaign.