navisajewellery[.]com

Analysis of the domain navisajewellery.com indicates active brand impersonation targeting Facebook, classified as high risk. The domain was registered on October 27, 2025, through Name SRS AB and remains operational as of July 12, 2026. It resolves to the IP address 148.113.24.65 and uses a Let's Encrypt SSL certificate. The page title, 'Navisa Jwellery,' does not directly reference Facebook, but the domain is explicitly identified in threat intelligence as impersonating the platform. Security vendor detections on VirusTotal show 12 of 95 engines flagging the domain, while it appears on two security blocklists and is blocked by at least two threat intelligence feeds. AlienVault OTX lists it in one threat intelligence pulse. Infrastructure analysis reveals the use of WordPress, MySQL, PHP, Nginx, and associated plugins such as Yoast SEO, Underscore.js, Swiper, and Slider Revolution, which are common in both legitimate and malicious sites but provide no definitive classification alone. The domain's Gridinsoft trust score is 0/100, reinforcing its suspicious status. While the exact content and mechanics of the impersonation remain unconfirmed due to lack of direct website analysis, the combination of brand targeting, vendor detections, and blocklist presence justifies immediate defensive action. Defenders should treat this domain as malicious, block it at the network level, and monitor for related indicators of compromise. Further investigation into associated infrastructure, such as the hosting IP and certificate chain, may reveal additional linked threats.