freefireid2023[.]com

On July 26, 2026 the domain freefireid2023.com was observed as an active generic phishing infrastructure. The registration record shows the domain was created through TurnCommerce, Inc. operating under the DBA NameBright.com. Current DNS resolution points to authoritative nameservers ns15.abovedomains.com and ns16.abovedomains.com, indicating use of a third‑party hosting service. An HTTP request to the root URL returns a 200 OK status, confirming that a web server is actively responding.

The domain has been added to at least one public security blocklist and is listed by the PhishDestroy sinkhole as blocked, yet it remains reachable, suggesting that blocklist propagation is incomplete. VirusTotal analysis reports that 14 of 91 scanned security vendors flagged the domain, providing independent confirmation of malicious intent. The domain appears on a single additional security blocklist, reinforcing the consensus that it is being used for credential‑ harvesting. No further technical details such as page title, SSL certificate attributes, or hosting IP address have been disclosed in the available intelligence, limiting the ability to attribute the infrastructure to a specific threat actor or to assess the underlying hosting environment.

Given the observed indicators, defenders should add freefireid2023.com to web‑filtering and DNS‑blocking policies, monitor outbound connections for attempts to resolve the domain, and consider sharing the indicator set with upstream threat‑intelligence feeds. Continuous re‑scanning with multi‑engine services is advised to capture any changes in detection scores. Until more detailed payload or page content is released, the domain should be treated as a high‑risk credential‑ harvesting site.