cir-acess[.]com

On July 23, 2026 the domain cir-acess.com was observed as an active brand-impersonation site targeting Facebook. The site was registered on 10 July 2025 through Cosmotown, Inc. and resolves to the IPv4 address 163.61.188.222, which is announced by AS153568 (NEW DHAKA HARDWARE) and geolocated to the United States. Four authoritative name servers—dns1.lytehosting.com, dns2.lytehosting.com, dns3.lytehosting.com and dns4.lytehosting.com—provide DNS resolution for the domain. No TLS certificate was presented; HTTP connections are served without encryption. The page title returned by the HTTP response is "CIRS - Cambridge Investment Research Access | Home Page", which does not reference the claimed Facebook brand and suggests the content has not been publicly disclosed.

VirusTotal records show that nine of ninety-five scanning engines flagged the domain as malicious, indicating a moderate level of detection consensus. The domain is listed on a single external security blocklist and has been actively blocked by the PhishDestroy feed. The current operational status is marked as offline, implying the hosting has been taken down or the site is otherwise inaccessible. Analysis indicates that the infrastructure—single IP, lytehosting name servers, and a recent registration—matches patterns commonly seen in low-cost phishing campaigns. The lack of an SSL certificate further reduces the credibility of the site but does not preclude credential harvesting.

Because the domain impersonates Facebook, any URLs containing cir-acess.com should be treated as suspicious, and email or web filters should continue to block or quarantine traffic to this host. Defenders are advised to add the IP address 163.61.188.222 and the domain name to deny lists, monitor for any re-hosting attempts, and verify that any internal users have not been directed to the domain via phishing emails.