discointernet[.]store

The domain discointernet.store has been identified as a brand impersonation threat specifically targeting Facebook, currently taken offline. This domain was created on August 21, 2025, and registered through Synergy Wholesale Accreditations Pty Ltd, resolving to IP address 103.42.108.46 with no SSL certificate present. The page title observed was 'Domain Parked With VentraIP Australia', indicating the domain was likely set up for fraudulent purposes before being disabled.

Security analysis reveals that this domain is flagged by 1 out of 95 VirusTotal vendors, and it appears on one security blocklist. Despite the low vendor detection rate, the targeted impersonation of Facebook elevates the risk level. The domain's registration details and lack of SSL further support the conclusion that it was intended for malicious activities such as credential theft or phishing campaigns.

Given that discointernet.store is now offline, the immediate threat is mitigated, but organizations should remain vigilant. It is recommended to block this domain at the network level, monitor for any similar domains using the unique seed '02eba8', and educate users about brand impersonation tactics. Continuous monitoring and proactive threat hunting are advised to prevent future incidents.