facebook[.]bora-bora[.]dk

facebook.bora-bora.dk is a newly registered domain (created 21 Feb 2026) that currently hosts a brand‑impersonation page targeting Facebook. The page title “Bora Bora - Dans og visuelt teater | Aarhus | Facebook” mimics the layout of a Facebook event or community, indicating an attempt to deceive users into believing the content is hosted by Facebook. The domain is classified as high‑risk and remains active as of 12 Jul 2026.

Technical inspection shows the domain resolves to the IPv6 address 2a03:2880:f177:185:face:b00c:0:25de, which maps to a German network owned by AS32934, the Facebook, Inc. infrastructure. The site serves over HTTPS with a Let’s Encrypt certificate (issuer E7) and returns an HTTP 302 redirect, a common technique to steer victims to a final malicious landing page. The page title and SSL details together provide enough visual cues for social‑engineering attacks.

Threat intelligence indicates that 3 of 95 VirusTotal scanners have flagged the domain, and it appears on one external blocklist (PhishDestroy). Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. The limited number of vendor detections leaves some uncertainty regarding the exact payload or credential‑harvesting mechanism, but the presence of a brand‑impersonation tag and the redirection behavior strongly suggest a phishing campaign.

Defenders should prioritize blocking facebook.bora-bora.dk at the DNS layer and add the IPv6 address to network‑level deny lists. Monitoring for outbound connections to this address and for HTTP 302 responses returning Facebook‑related titles will help detect exploitation attempts. Users should be reminded not to follow links that appear to originate from Facebook but contain unexpected domain names. Continuous updating of threat‑intel feeds will ensure that any future changes to the site are captured promptly.