policy-action-alert-console[.]pages[.]dev

On 23 July 2026 the domain policy-action-alert-console.pages.dev was observed to be offline. The site was created on 21 February 2026 and is registered through Cloudflare, Inc., using the nameservers alfred.ns.cloudflare.com and betty.ns.cloudflare.com. DNS resolution points to IP 172.66.44.140, which belongs to AS13335 Cloudflare, Inc. in the United States. The TLS certificate was issued by Google Trust Services under the WE1 profile, indicating a valid HTTPS endpoint, and the server advertised HSTS and HTTP/3 support.

An HTTP GET returned a 403 status code, suggesting that the content is not publicly accessible at the time of analysis. The page title reported by the crawler is “Meta for Business | Privacy Center”, and the domain is classified as a social‑media phishing campaign that impersonates Facebook. The malicious infrastructure has been listed on a single security blocklist and is actively blocked by PhishDestroy. VirusTotal analysis shows that 12 of 93 security vendors have flagged the domain, reinforcing the suspicion of malicious intent.

Independent reputation scoring from Gridinsoft assigns a trust score of 0 out of 100. While the current offline status limits direct observation of the malicious payload, the combination of brand impersonation, recent registration, Cloudflare‑based hosting, and multiple vendor detections provides sufficient confidence to treat the domain as hostile. Defenders should add the domain and its resolving IP address to inbound and outbound filtering rules, monitor for any future re‑activation, and ensure that any user‑initiated connections to pages.dev subdomains are subjected to enhanced scrutiny. Continuous threat‑intel feeds should be consulted for updates on blocklist status and additional indicators of compromise.