tnhb3kscfbb2vi4ubdxt4dx2[.]pages[.]dev

This domain, tnhb3kscfbb2vi4ubdxt4dx2.pages.dev, is a confirmed brand impersonation site targeting Facebook. The site poses a high risk as it attempts to trick users into believing they are interacting with a legitimate Facebook service, potentially leading to the theft of personal information or credentials.

Analysis indicates that the domain was created on November 20, 2025, and is registered through Cloudflare, Inc. Infrastructure analysis reveals that it resolves to the IP address 2607:f8b0:4004:c07::93, which is located in the US and associated with AS15169 Google LLC. The domain's SSL certificate is issued by Google Trust Services / WE1. Notably, 3 out of 95 security vendors on VirusTotal have flagged this domain as malicious, and it appears on one security blocklist, specifically PhishDestroy.

If a user has visited this site, they should immediately check their Facebook account for any unauthorized activity. It is recommended to change account passwords and enable two-factor authentication (2FA) to enhance security. Users should also run a full system scan using their antivirus software to ensure no malicious software was installed. Additionally, reporting the incident to Facebook's security team through their official channels can help in mitigating potential damage.