zwzmkgrzwr[.]yoga

This domain is flagged for elevated-risk brand impersonation targeting Apple Inc. through a fraudulent storefront labeled 'Facebook Shop.' The threat type involves deceptive credential harvesting, where victims are lured into entering sensitive account information under the pretense of accessing Apple services or promotions. The domain’s infrastructure and rapid detection by security systems indicate a deliberate attempt to exploit trust in the targeted brand, posing significant risks to user data integrity and financial security.

Analysis reveals the domain zwzmkgrzwr.yoga was registered on July 31, 2025, through NameSilo, LLC, a registrar frequently associated with abusive domains. It resolves to the IP address 45.204.212.94, hosted under AS62468 (VpsQuan L.L.C.) in Hong Kong, a network segment with a history of malicious activity. The domain appears on one security blocklist (PhishDestroy) and is detected by 18 out of 95 security vendors on VirusTotal, reflecting moderate to high confidence in its malicious nature. The SSL certificate (R12) is issued by a non-extended validation provider, further reducing trustworthiness. The page title 'Facebook Shop' suggests an attempt to mimic social commerce platforms, likely to bypass initial user skepticism.

Mitigation requires immediate action from both users and network defenders. Users who encountered this domain should reset credentials for any accounts accessed during the interaction, particularly Apple IDs, and enable multi-factor authentication where available. Network administrators are advised to block the domain and its resolving IP (45.204.212.94) at the perimeter, while monitoring for related indicators of compromise, such as unusual login attempts or phishing emails referencing Apple or Facebook services. Organizations should also review registrar policies for domains created under NameSilo, LLC, and assess the risk of similar impersonation attempts targeting their brand. Proactive threat hunting for domains with similar naming patterns (e.g., random character strings followed by .yoga) can help identify emerging campaigns.