bucaramangadc[.]com

This domain is flagged as an elevated-risk brand impersonation threat specifically targeting Facebook users. Analysis indicates the site was designed to deceive victims into entering credentials by mimicking the appearance and functionality of legitimate Facebook login portals, potentially leading to account compromise or further social engineering attacks. Infrastructure analysis reveals the domain bucaramangadc.com was registered on August 30, 2021, through Hello Internet Corp. It resolves to the IP address 162.214.170.191, located in the United States under AS46606 (Unified Layer). The domain appears on two security blocklists and is detected by 12 out of 95 security vendors on VirusTotal. No SSL certificate was present, increasing the likelihood of interception or tampering during data transmission. The page title, 'Bienvenidos a Bucaramanga DC, una ciudad perfecta,' does not align with the expected branding of Facebook, suggesting an attempt to obscure the malicious intent. Mitigation steps for this type of threat include immediate blocking of the domain and associated IP at the network perimeter. Organizations should deploy indicators of compromise (IOCs) such as the domain, IP, and registrar details into security monitoring systems to detect potential lateral movement or credential reuse. End-users should be educated on recognizing brand impersonation tactics, including verifying domain authenticity, checking for SSL certificates, and scrutinizing page titles or content that deviates from expected branding. Multi-factor authentication (MFA) should be enforced for all accounts to mitigate the impact of credential theft.