business-for-connection[.]pages[.]dev

Business-for-connection.pages.dev was observed hosting a page titled “Facebook - Connexion ou inscription” and is classified as a brand‑impersonation site targeting Facebook. The domain was registered on March 03 2026 through Cloudflare, Inc. and resolves to the IP address 157.240.253.35, which belongs to Cloudflare’s AS13335 network located in the United States. DNS resolution uses the Cloudflare nameservers brynne.ns.cloudflare.com and chase.ns.cloudflare.com. The site served over HTTPS with a Google Trust Services / WE1 certificate and enforced HSTS, while supporting HTTP/3, indicating a modern Cloudflare‑managed configuration. HTTP requests return a 403 status code, and the domain is currently taken offline.

Multiple external reputation services flag the domain as malicious. Google Safe Browsing lists it as a social‑engineering threat, and PhishDestroy has added it to its blocklist. VirusTotal reports 13 of 93 scanning engines labeling the domain as malicious, and the site appears on one additional security blocklist. Trust‑score services are extremely low: Gridinsoft assigns 0 / 100, and Scamadviser reports 1 / 100.

The combination of a brand‑specific page title, the impersonation label, and the low trust scores strongly suggests a phishing campaign designed to harvest Facebook credentials. While the infrastructure details are concrete, the exact payload or login form content has not been publicly captured, leaving the precise phishing technique uncertain. Defenders should proactively block the domain at DNS and web‑filter layers, monitor for outbound connections to the associated Cloudflare IP, and update email and web‑gateway signatures to include the observed page title and SSL fingerprint. Continuous re‑evaluation is advised in case the site is re‑activated or the underlying infrastructure is repurposed for further impersonation attempts.