aaiblondon[.]com

The domain aaiblondon.com has been identified as a brand impersonation threat targeting Facebook. Analysis confirms this domain was actively used for phishing operations designed to mimic Facebook login pages or related services. The domain is currently offline, but prior activity indicates malicious intent to deceive users into disclosing credentials or sensitive information under false pretenses. Infrastructure analysis reveals the domain was flagged by 5 of 95 security vendors on VirusTotal, registered through Porkbun LLC on July 28, 2024, and resolved to the IP address 173.252.167.40. It appears on one security blocklist and holds a Gridinsoft trust score of 0/100. The site presented a page title of 'AaibLondon – Niche Perfumes,' which does not align with the impersonated brand, and employed technologies including WordPress, MySQL, PHP, jQuery Migrate, jQuery, and HTTP/3. The SSL certificate was issued by Let's Encrypt, a common feature in both legitimate and malicious domains. Current status indicates the domain has been taken offline, likely due to detection and mitigation efforts. Organizations and users are advised to block the domain and associated IP address at the network level. Security teams should review logs for connections to 173.252.167.40 or aaiblondon.com, particularly from July 28, 2024, onward. If credentials were entered on this site, immediate password resets and multi-factor authentication enforcement are recommended. Monitoring for similar domains registered via Porkbun LLC or resolving to the same IP may help identify related threats.