to[.]noreplybussinesfacebook[.]com

This domain is flagged for elevated-risk brand impersonation, specifically targeting Facebook’s business infrastructure. Analysis indicates the domain mimics Facebook’s Business Help Center, a tactic commonly used to deceive enterprise users into disclosing credentials or sensitive corporate data. The threat type is narrowly classified as brand impersonation, not generic phishing, due to its focus on replicating Facebook’s official business support channels. Infrastructure analysis reveals multiple concrete indicators of malicious activity. The domain to.noreplybussinesfacebook.com resolves to IP address 172.67.181.29, hosted on AS13335 (Cloudflare, Inc.) in the United States. It appears on one security blocklist and is flagged by 18 out of 95 security vendors on VirusTotal. Registered through Dynadot Inc on May 12, 2026, the domain uses a Let’s Encrypt SSL certificate (serial number E7). The page title, 'Business Help Center,' directly mirrors Facebook’s legitimate branding, further confirming the impersonation intent. Mitigation steps for this specific threat type include immediate domain blocking at the network perimeter and endpoint levels. Organizations should deploy indicators of compromise (IOCs) such as the domain, IP address, and SSL certificate hash into security controls. User awareness training should emphasize verifying URLs for official Facebook business domains (e.g., business.facebook.com) and reporting suspicious communications. Given the domain’s current offline status, monitoring for re-emergence or related infrastructure (e.g., subdomains, newly registered lookalikes) is recommended. Security teams should also review logs for prior connections to 172.67.181.29 or the domain to assess potential exposure.