headabovetherim[.]com

The domain headabovetherim.com was registered through GoDaddy.com, LLC on March 04, 2017 and presently resolves to IP address 188.114.96.3, an address owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. DNS resolution is handled by the Cloudflare nameservers dana.ns.cloudflare.com and phil.ns.cloudflare.com, and the site serves an SSL certificate issued by Google Trust Services under the WE1 designation, indicating a valid HTTPS endpoint despite the malicious purpose. The page title observed during the brief crawl – "Head Above The Rim Pop Up Clinic Home - Head Above The Rim" – does not directly reference the impersonated brand, yet the infrastructure metadata classifies the campaign as a social media phishing operation that impersonates Facebook. Technical fingerprints show a typical WordPress stack with MySQL, PHP, Bootstrap, Yoast SEO, and ancillary services such as Google Maps, YouTube embeds, and Sovrn//Commerce, suggesting a generic content management deployment repurposed for credential harvesting.

Google Safe Browsing has flagged the domain for social engineering, and the Gridinsoft trust score is 0 out of 100, reflecting a high confidence of malicious intent. The domain appears on one security blocklist and has been actively blocked by the PhishDestroy mitigation service. VirusTotal reports that 15 of 95 security vendors have flagged the domain, reinforcing the detection consensus. Additionally, AlienVault OTX lists the domain in 17 threat‑intelligence pulses, indicating repeated observation across multiple threat‑sharing feeds.

At the time of this report (July 23, 2026) the site is taken offline, which may be the result of takedown actions or temporary hosting changes. However, the persistence of the underlying infrastructure – a Cloudflare‑protected WordPress instance with a valid SSL certificate – suggests that the operators could reactivate the site or clone the setup to new domains. Defenders should therefore add headabovetherim.