uun[.]trl[.]mycrazydomains[.]me

This domain, uun.trl.mycrazydomains.me, is actively engaged in brand impersonation targeting Facebook users. Registered on May 6, 2025, through Dreamscape Networks International Pte Ltd, the domain resolves to IP address 74.91.194.193 and remains operational as of July 12, 2026. Analysis indicates the use of WordPress as the underlying content management system, alongside supporting technologies including MySQL, PHP, Yoast SEO, Nginx, Apache HTTP Server, jQuery Migrate, and jQuery. The domain has been assigned a Gridinsoft trust score of 0 out of 100, reflecting a complete lack of credibility in automated reputation assessments. Security vendors have flagged the domain with 14 detections out of 95 on VirusTotal, confirming its malicious classification. The domain appears on three distinct security blocklists, including PhishDestroy, PhishingDB, and BLP-Malware, further corroborating its status as a confirmed phishing threat. The SSL certificate is issued by Let’s Encrypt, which is commonly observed in both legitimate and malicious infrastructure due to its free and automated issuance process. The page title, 'Welcome -', provides minimal insight into the specific content or tactics employed, though the domain’s classification as a brand impersonation threat explicitly targets Facebook. While the exact phishing kit or payload remains unconfirmed, the domain’s infrastructure and detection patterns align with credential harvesting campaigns. Defenders should prioritize blocking this domain at the DNS and network levels, as well as monitoring for related subdomains or IP-based connections to 74.91.194.193. Given its continued activity and presence on multiple blocklists, organizations are advised to treat this domain as a high-risk indicator of compromise. Additional scrutiny of related infrastructure, such as co-hosted domains or shared SSL certificates, may uncover further malicious activity associated with this threat actor.