leads-facebook[.]pages[.]dev

PhishDestroy identifies leads-facebook.pages.dev as an active brand-impersonation domain targeting Facebook users. The domain is hosted on Cloudflare Pages and resolves to IP 172.66.47.18, carrying a Let's Encrypt SSL certificate. No known drainer kit payload has been observed, but the page content mimics Facebook branding to trick visitors into entering credentials or downloading malicious software. Technical indicators confirm this domain remains under investigation with a clean VirusTotal score of 0/95 detections as of the latest scan. The registrar is Cloudflare, Inc., and the domain is served from a Cloudflare edge IP. No Google Safe Browsing (GSB) classification or public blocklist entries have been recorded to date. Creation and first-seen dates are consistent with a recently deployed impersonation campaign aimed at social-media users seeking leads or business opportunities. Current status is active with a risk level marked under_investigation. PhishDestroy continues monitoring for payload changes or blocklist escalations. Users are advised to avoid clicking links to leads-facebook.pages.dev and verify any unfamiliar Facebook-related domains through PhishDestroy’s free lookup tool. Remaining risk includes potential credential theft or malware delivery should the domain’s content evolve into a live crypto drainer or fake login portal.