policy-suspicious-event-scanner[.]pages[.]dev

The domain policy-suspicious-event-scanner.pages.dev is identified as a brand impersonation threat, specifically targeting Meta for Business. This domain was used to deceive users into believing it was an official Meta for Business page, potentially leading to credential theft or other malicious activities.

Infrastructure analysis reveals that the domain is registered through Cloudflare, Inc., and resolves to the IP address 172.66.44.137, which is located in the United States under the autonomous system AS13335. The domain was created on October 17, 2025. The SSL certificate for the domain is issued by Google Trust Services / WE1, which might have been used to gain user trust. The domain appears on 1 security blocklist and has been flagged by 14 out of 95 security vendors on VirusTotal, indicating a significant level of suspicion.

The domain is currently offline, having been taken down. However, it remains on security blocklists, and the risk of residual threats or reactivation should not be overlooked. Users are advised to avoid visiting this domain and to remain vigilant for similar impersonation attempts. Security teams should monitor for any signs of the domain being brought back online and ensure that appropriate mitigations are in place.