bfmg[.]com[.]ua

The domain bfmg.com.ua has been identified as a brand impersonation threat specifically targeting Facebook. Currently offline, this domain was found to be engaged in fraudulent activity, posing as the social media giant to deceive users. The page title displayed was "Благодійний фонд "Міжнародні горизонти"", suggesting a charitable front that likely aimed to collect donations or personal information under false pretenses.

Technical analysis reveals that the domain was registered through ТОВ "ХОСТПРО ЛАБ" and created on May 18, 2023. It resolves to the IP address 188.114.96.3 and uses an SSL certificate issued by Google Trust Services / WE1. VirusTotal flags this domain as malicious, with 13 out of 95 security vendors marking it as harmful. Additionally, the domain appears on two security blocklists and has been found in 16 threat intelligence pulses on AlienVault OTX, indicating widespread recognition of its malicious nature.

With the domain now taken offline, the immediate risk is mitigated, but users who may have interacted with the site should monitor their accounts for any signs of compromise. It is advised to change passwords for any accounts that may have been used on the fraudulent site and to enable two-factor authentication where possible. Organizations should also review logs for any connections to this domain to ensure no data exfiltration occurred. PhishDestroy recommends blocking the domain at the network level and reporting any associated IP addresses to threat intelligence platforms for further analysis.