toogreattocancel[.]dk

Analysis of toogreattocancel.dk shows a live web service returning HTTP 200. The site is hosted behind Cloudflare (ASN 13335) with the origin address 23.227.38.65 located in Canada. Registration was performed through DANDOMAIN A/S and the domain was created on 20 September 2021. The TLS certificate is issued by Let’s Encrypt (E8) and HSTS is enabled.

Front‑end fingerprinting reveals the use of Shopify, Trustpilot widgets, Cookiebot consent management, Facebook Pixel, and HTTP/3 support, indicating a typical e‑commerce stack. The page title “Too Great To Cancel – Spændende afbudsrejser” does not reference the targeted brand, but the domain is flagged as a brand‑impersonation campaign targeting Facebook. The threat is corroborated by inclusion on the PhishDestroy blocklist and by a Gridinsoft trust score of 0 / 100. VirusTotal reports that one of ninety‑three scanning engines flagged the domain, providing additional confirmation of malicious intent.

No further public analysis of the page content has been released, so the exact method of Facebook impersonation remains unknown. Defenders should block DNS resolution for toogreattocancel.dk, add the domain to URL filtering policies, and monitor outbound connections to the associated Cloudflare IP range. Continuous re‑scanning with multi‑engine services is advised to capture any changes in the detection profile. Organizations that rely on Facebook authentication should educate users about unsolicited login prompts and enforce multi‑factor authentication to mitigate credential compromise.