advertising-account-oversight-hub[.]pages[.]dev

This domain advertising-account-oversight-hub.pages.dev was observed hosting a page titled “Facebook – Anmelden oder Registrieren”. The page title directly references Facebook, confirming the reported brand impersonation. Technical analysis shows the site was served over HTTPS with HSTS enabled and used HTTP/3, indicating modern web stack. The TLS certificate was issued by Google Trust Services under the WE1 identifier, a legitimate certificate authority, which is commonly abused by threat actors to lend credibility. DNS resolution points to the IP address 157.240.0.35, which belongs to AS13335 Cloudflare, Inc. and is located in the United States. The domain is registered through Cloudflare, Inc., and uses the nameservers miguel.ns.cloudflare.com and veda.ns.cloudflare.com, a pattern frequently seen in fast‑flux or disposable phishing infrastructure.

Reputation checks are overwhelmingly negative. Gridinsoft assigns a trust score of 0 out of 100, and Scamadviser reports a score of 1 out of 100. VirusTotal scans returned 15 detections out of 93 security vendors, and the domain appears on at least one public blocklist. Google Safe Browsing flags the site for social engineering, and PhishDestroy has actively blocked it. An HTTP GET returned a 403 status, suggesting the content is no longer publicly accessible; the current status is listed as taken offline. The domain was created on 3 March 2026, indicating a relatively recent registration.

No additional malware or payload information is available, and the specific phishing kit or payload URL has not been disclosed. Consequently, uncertainty remains around the exact content that was served before the takedown and whether any credential harvesting occurred. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the same hostnames or IP addresses, and add the associated IP and nameservers to threat‑intel feeds.