nt5jc-uowkl9-amo9e7-shr-6ry[.]pages[.]dev

On July 25, 2026, the domain nt5jc-uowkl9-amo9e7-shr-6ry.pages.dev was identified as a brand impersonation threat targeting Facebook. The page title 'Facebook – log in or sign up' suggests that the site was designed to mimic Facebook's login or registration page, potentially to deceive users into providing sensitive information. The domain is currently offline, with an HTTP status code of 403, indicating that the server is refusing to respond to the request. This status suggests that the site may have been taken down or is no longer active.

However, the domain was previously hosted in the United States under Cloudflare, Inc. (AS13335), and resolved to the IP address 157.240.8.35. The SSL certificate for the domain was issued by Google Trust Services, which is unusual for a malicious site but can be indicative of a legitimate hosting service being abused. The Gridinsoft trust score for this domain is 0/100, reflecting a very low level of trust. PhishDestroy has blocked this domain, and it appears on one security blocklist.

While 12 out of 91 security vendors on VirusTotal flagged this domain, the relatively low detection rate might suggest either a new or relatively unknown threat. Defenders should be cautious and monitor for any attempts to re-register or re-host this domain, as it poses an elevated risk of brand impersonation and potential phishing attacks. The exact content of the page has not been fully analyzed, but the page title and known brand impersonation indicate that users should be wary of any similar domains and verify the authenticity of any login pages they encounter.