cloudserver138970[.]home[.]pl

This domain, cloudserver138970.home.pl, is actively flagged as a high-risk brand impersonation threat targeting Facebook. Infrastructure analysis reveals the domain resolves to the IP address 188.128.239.32 and is currently listed on two security blocklists, including PhishDestroy and PhishingDB. The domain was registered through home.pl S.A. on December 05, 1997, though its long registration history does not mitigate its current malicious use. The SSL certificate is also issued by home.pl S.A., which aligns with the domain's registration details but provides no assurance of legitimacy given the active threat status. The page title, 'Pralnia Lemon Fresh | Pierzemy wszystko … prócz kieszeni,' does not align with the identified brand target, Facebook, suggesting either a compromised legitimate site or an attempt to obfuscate the phishing content. This discrepancy raises uncertainty about the exact nature of the malicious activity hosted on the domain. However, the domain has been explicitly categorized as impersonating Facebook, indicating the presence of credential harvesting or social engineering content designed to deceive users into divulging sensitive information. Defenders should treat this domain as an active threat, given its presence on multiple blocklists and a Scamadviser trust score of 1/100. VirusTotal data indicates that 6 out of 95 security vendors have flagged the domain as malicious, further corroborating its high-risk status. The domain remains operational as of July 12, 2026, and no evidence suggests it has been taken down or remediated. Network security teams are advised to block traffic to and from 188.128.239.32 and monitor for any attempts to access cloudserver138970.home.pl within their environments. Additional scrutiny should be applied to any internal systems that have interacted with this domain or its associated IP address.