customer-support-system-feedback-response-hub[.]pages[.]dev

Analysis of the domain customer-support-system-feedback-response-hub.pages.dev indicates a high-risk brand impersonation campaign targeting Facebook users. The domain, registered through Cloudflare, Inc. on March 3, 2026, was flagged for social engineering by Google Safe Browsing and blocked by PhishDestroy. It appears on one security blocklist, with 14 of 93 security vendors on VirusTotal detecting malicious activity. The page title, 'Facebook – log in or sign up,' confirms the impersonation of the Facebook login portal, aligning with the reported scam type of brand impersonation.

Infrastructure analysis reveals the domain resolves to IP 157.240.8.35, hosted under AS1335 (Cloudflare, Inc.) in the United States. Nameservers asa.ns.cloudflare.com and emerson.ns.cloudflare.com further link the domain to Cloudflare’s infrastructure. The SSL certificate, issued by Google Trust Services (WE1), and detected technologies including HSTS, Cloudflare, and HTTP/3, suggest an attempt to appear legitimate while leveraging Cloudflare’s security features to evade detection. The domain’s Scamadviser and Gridinsoft trust scores of 1/100 and 0/100, respectively, reinforce its classification as malicious.

At the time of analysis (July 24, 2026), the domain is offline, returning an HTTP 403 status. While the exact content and functionality of the phishing page remain unconfirmed due to its current inaccessibility, the available evidence—including the page title, brand target, and detection by multiple security vendors—strongly supports its role in a Facebook credential-harvesting campaign. Defenders should treat this domain as compromised and maintain blocklist entries to prevent user exposure. Further monitoring of Cloudflare Pages domains with similar naming patterns is recommended, as this infrastructure may continue to be exploited for brand impersonation attacks.