kivorn-biz-selpat-15126[.]pages[.]dev

Analysis conducted on July 23, 2026 identifies the domain kivorn-biz-selpat-15126.pages.dev as an active brand‑impersonation infrastructure targeting Facebook. The domain was registered on March 03, 2026 through Cloudflare, Inc. and is hosted on Cloudflare’s edge network (AS13335) with the public address 157.240.0.35 located in the United States. DNS resolution points to the Cloudflare name servers chelsea.ns.cloudflare.com and steven.ns.cloudflare.com, confirming the use of Cloudflare's DNS and CDN services. The site responded with HTTP 403, indicating the server is intentionally denying access, and the TLS certificate is issued by Google Trust Services under the WE1 root, a common certificate chain for Cloudflare‑protected sites.

The page title returned by the server is “Facebook - Connexion ou inscription”, a direct reference to the French Facebook login page, and the threat intelligence tags classify the content as a Facebook impersonation scam. Reputation services assign extremely low trust scores: Scamadviser rates the domain 1 / 100, Gridinsoft 0 / 100, and the domain appears on a single security blocklist. VirusTotal scanning shows that 14 of 93 anti‑malware engines flag the domain, reinforcing the malicious assessment. The domain is listed as blocked by the PhishDestroy blocklist, and it currently shows an offline status, suggesting that the hosting provider has taken it down or the operators have withdrawn the site.

Defenders should continue to block the domain at the network perimeter, monitor the associated IP range (157.240.0.0/24) for any future malicious payloads, and incorporate the observed DNS nameserver pattern into threat‑intel feeds. Because the domain uses Cloudflare’s HTTP/3 and HSTS, any future re‑hosting on the same infrastructure could inherit the same security headers, making detection via HTTP status less reliable. Continuous re‑scanning with multi‑vendor engines is recommended to capture any changes in the payload or hosting.