facebook[.]red-hat[.]shop

The domain facebook.red-hat.shop is currently active and resolves to the IPv4 address 52.54.199.95. No TLS certificate is presented for the host, and the nameserver query returned NS_NOT_FOUND, indicating that authoritative name server information is not publicly resolvable. VirusTotal records show that 18 of 91 security vendors have flagged the domain, consistent with its classification as a generic phishing site. The limited infrastructure data suggests a simple hosting setup, but the absence of certificate and nameserver details hampers deeper attribution. Analysts have not yet captured page content or landing‑page characteristics, so the exact phishing campaign tactics remain unknown. Defensive teams should add both the domain and its resolving IP to block lists, enforce URL filtering for the exact hostname, and monitor DNS queries for any future resolution changes. Continuous scanning with malware‑analysis services is advised to capture any payloads that may later be associated with the host.