username[.]business-minagne[.]com

This domain, username.business-minagne.com, was identified as part of a phishing infrastructure targeting Facebook users, with evidence indicating brand impersonation tactics. Registered on July 9, 2024, through Aceville Pte. Ltd., the domain resolved to the IP address 172.67.218.44, hosted on Cloudflare's network (AS13335) in the United States. The SSL certificate was issued by Google Trust Services (WE1), a common feature in phishing campaigns leveraging legitimate infrastructure providers to evade detection. The page title, 'Retrictions Information,' suggests an attempt to mimic Facebook's account restriction notifications, a known social engineering technique to harvest credentials.

Analysis reveals the domain was flagged by 16 of 95 security vendors on VirusTotal, indicating moderate detection coverage, though the absence of additional blocklist entries suggests it may have operated with limited exposure. It was subsequently blocked by PhishDestroy and assigned a Gridinsoft trust score of 0/100, reinforcing its classification as malicious. The domain is currently offline, though its prior use of Cloudflare nameservers (arushi.ns.cloudflare.com and trevor.ns.cloudflare.com) and HTTP/3 protocol aligns with common phishing infrastructure patterns designed for resilience and performance. Defenders should treat this domain as part of a broader Facebook-targeted phishing campaign.

While the exact content of the phishing page remains unanalyzed, the combination of brand impersonation, Cloudflare hosting, and detection by multiple security vendors warrants continued monitoring. Organizations are advised to block the domain and its resolving IP at the network level, review logs for prior interactions, and alert users to the risks of social media phishing scams. Further investigation into the registrar (Aceville Pte. Ltd.) may reveal additional linked domains, given its historical association with malicious activity.