clinicaroua[.]ro

This domain, clinicaroua.ro, is actively impersonating Facebook through a social media phishing scheme targeting users of a cosmetic surgery clinic. Analysis indicates the domain was registered on May 5, 2015, and currently resolves to 91.195.28.138, hosted on AS44043 in Romania. The site presents itself with the page title 'Clinica Roua Ploiesti - Chirurgie estetică, plastică și reconstructivă,' which does not directly reference Facebook but aligns with the broader phishing campaign described in threat intelligence. Infrastructure analysis reveals the domain uses four nameservers (ns1.mxserver.ro through ns4.mxserver.ro) and has MX records pointing to spamguard1.mxserver.ro and spamguard2.mxserver.ro, suggesting an email infrastructure that may be leveraged for phishing or spam distribution. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites. Detected technologies include WordPress, MySQL, PHP, and plugins such as Yoast SEO, Tiny Slider, and Swiper, which are frequently exploited in phishing campaigns due to their widespread use and known vulnerabilities. The domain is flagged by 13 of 95 security vendors on VirusTotal and appears on two security blocklists, including PhishDestroy and PhishingDB. It has also been referenced in 18 threat intelligence pulses on AlienVault OTX, further corroborating its malicious classification. Trust scores from Gridinsoft and Scamadviser are both at 0/100 and 1/100, respectively, indicating a high level of suspicion. While the exact mechanics of the phishing operation remain unconfirmed, the domain's association with social media phishing and its presence on multiple blocklists warrant immediate defensive action. Defenders should block the domain at the DNS and network levels, monitor for related email activity, and investigate any user interactions with the site.