why-reals[.]business-minagne[.]com

Analysis of the domain why-reals.business-minagne.com, created on July 09, 2024 and currently taken offline, shows a clear pattern of brand impersonation targeting Facebook. The domain resolves to IP address 104.21.24.100, which is hosted within the Cloudflare network (AS13335, United States). DNS records list the authoritative nameservers arushi.ns.cloudflare.com and trevor.ns.cloudflare.com, confirming Cloudflare as the DNS provider. The TLS certificate presented by the site is issued by Google Trust Services under the WE1 certificate authority, indicating a legitimate‑looking HTTPS endpoint that could be used to lend credibility to a phishing page. Technical fingerprints include Cloudflare Browser Insights, Cloudflare services, and HTTP/3 support, all typical of modern infrastructure used by malicious operators to improve performance and evade simple network‑level detection.

Reputation data shows the domain appears on one security blocklist and has been manually blocked by PhishDestroy. The registrar record lists Aceville Pte. Ltd. as the registrar, and the Gridinsoft trust score is 0 out of 100, reflecting an extremely low confidence rating. VirusTotal scans have flagged the domain in 16 of 95 security vendors, reinforcing the suspicion of malicious use. The page title returned from the site is "Retrictions Information," which does not directly reference the targeted brand and suggests the content may have been altered or is incomplete, but the overall classification is identified as social media phishing.

Uncertainty remains regarding the exact payload or credential‑harvesting mechanism, as no visual or page‑content analysis is available. Defenders should block the domain at network perimeters, update URL filtering and DNS threat feeds to include the full hostname, and monitor for any related subdomains that may be created under the same registrar or Cloudflare account. Continuous monitoring of the IP address 104.21.24.