polkongres[.]live

On July 25, 2026, the domain polkongres.live was flagged as a high‑risk brand‑impersonation infrastructure targeting Facebook users. The site presents a page with the title “Twój Partner w Doskonałej Obsłudze Konferencji Technicznych,” which does not contain any direct reference to the Facebook brand, but the intelligence set classifies the operation as a social‑media phishing campaign that claims to impersonate Facebook. The domain resolves to the IPv4 address 92.113.16.148, located in Germany and announced by AS47583, which belongs to Hostinger International Limited. Registration details indicate the domain was provisioned through HOSTINGER operations, UAB, confirming the same hosting provider that supplies the IP address.

Technical analysis shows the web server redirects with an HTTP 301 response and serves a TLS certificate issued by Let’s Encrypt (R13). The certificate is valid for the domain and does not appear to be self‑signed, but the presence of a free certificate does not mitigate the risk. The site runs a WordPress stack, leveraging MySQL, PHP, and a collection of front‑end libraries including UIKit, Underscore.js, Swiper, and the All in One SEO plugin, suggesting a typical content‑management deployment rather than a custom phishing kit.

MX records point to mx1.hostinger.com (priority 5) and mx2.hostinger.com (priority 10), both operated by the same hosting provider, indicating that email services are also hosted on the compromised infrastructure. Detection evidence shows that one of ninety‑five VirusTotal scanners flagged the domain, and the domain appears on four independent blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—demonstrating consensus among external security feeds that the site is malicious. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the assessment of a dangerous payload.