facebook-d9e[.]pages[.]dev

The domain facebook-d9e.pages.dev is currently active and classified as a high-risk brand impersonation phishing campaign. This domain specifically targets users by impersonating Meta, leveraging the page title 'AI-Gated Architecture Proposal | Meta' to deceive visitors into believing they are accessing a legitimate corporate resource. The threat type is credential harvesting, with potential secondary objectives including malware distribution or social engineering attacks under the guise of Meta’s branding. Analysis indicates this domain was registered through Cloudflare, Inc., and resolves to the IP address 172.66.47.152, which is geolocated in the United States under AS13335 (Cloudflare, Inc.). The domain was created on February 21, 2026, an anomalous future date suggesting potential obfuscation or misconfiguration. Detection metrics reveal that 16 of 95 security vendors on VirusTotal have flagged this domain as malicious, while it appears on one additional security blocklist. Notably, the domain lacks an SSL certificate, increasing the likelihood of interception or tampering during data transmission. Infrastructure analysis reveals the use of Cloudflare’s content delivery network, which may be exploited to mask the true origin of the phishing server. As of the latest assessment, facebook-d9e.pages.dev remains active and unmitigated. Organizations and end-users are advised to implement immediate countermeasures, including blocking the domain and IP address at the network perimeter, updating endpoint protection rules to detect and quarantine related artifacts, and conducting user awareness training to recognize brand impersonation tactics. Security teams should monitor for indicators of compromise, such as unusual login attempts or data exfiltration patterns, particularly targeting credentials associated with Meta or affiliated services. Proactive threat hunting is recommended to identify any lateral movement or persistence mechanisms that may have been deployed via this campaign.