bdybr957izjfpa8kt3tdjsm1[.]pages[.]dev

This domain is actively impersonating Facebook to deceive users into disclosing login credentials or other sensitive information. The site mimics legitimate Facebook pages, potentially tricking visitors into entering usernames, passwords, or personal details under false pretenses. Such attacks often lead to account takeovers, unauthorized access to connected services, or further social engineering campaigns targeting contacts of compromised accounts. Analysis indicates the domain was registered on November 20, 2025, through Cloudflare, Inc. and remains operational. It is flagged by 3 out of 95 security vendors on VirusTotal, with one confirmed blocklist entry. The domain resolves to IP address 172.253.62.105, hosted under Google LLC (AS15169), and presents a misleading page title labeled 'Google.' The SSL certificate is issued by Google Trust Services, which may lend a false sense of legitimacy to unsuspecting users. If you visited bdybr957izjfpa8kt3tdjsm1.pages.dev, immediately cease all interaction and do not enter any credentials. Reset passwords for Facebook and any accounts sharing the same credentials using a secure device. Enable multi-factor authentication where available. Monitor linked accounts for unauthorized activity, including messages sent or posts made without consent. Report the domain to your security team or platform administrators to aid in broader mitigation efforts. Avoid clicking on links from untrusted sources, even if they appear to originate from known contacts.