com-verified[.]cfd

The domain com-verified.cfd has been identified as a phishing site engaged in brand impersonation, specifically targeting Facebook users. Analysis of the page title, 'Official Notice from Facebook,' confirms the intent to deceive victims into believing they are interacting with legitimate Facebook communications. The domain is currently offline, but prior activity indicates a high-risk threat profile for credential harvesting or social engineering attacks. Infrastructure analysis reveals the domain was registered on November 3, 2025, through Atak Domain Bilgi Teknolojileri A.Ş. and resolves to the IP address 103.149.252.110, located in Vietnam under AS135918 (VIET DIGITAL TECHNOLOGY LIABILITY COMPANY). Security vendor detection is significant, with 16 of 95 VirusTotal vendors flagging the domain as malicious. The domain appears on two security blocklists, and its SSL certificate (R13) further indicates suspicious infrastructure. The combination of a recently registered domain, low-reputation hosting, and confirmed blocklist presence aligns with known phishing campaign patterns. Current status indicates the domain has been taken offline, likely due to enforcement actions or infrastructure changes. However, the risk of reemergence remains elevated given the domain's recent creation and targeted impersonation of a high-value brand. Organizations and users are advised to block the domain and associated IP address (103.149.252.110) at the network level. Security teams should monitor for similar domains registered through the same registrar or resolving to the same IP range. End users should be educated on recognizing brand impersonation tactics, particularly in unsolicited communications, and encouraged to verify domain authenticity before entering credentials.