fayavo[.]icu

This domain, fayavo.icu, is actively hosting a fake login page designed to impersonate the legitimate Messenger platform. Analysis indicates the page is engineered to harvest user credentials by mimicking the authentic interface, a tactic commonly employed in credential theft campaigns. The domain specifically targets users expecting to access Messenger services, increasing the likelihood of successful deception due to the high familiarity and trust associated with the brand. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification of this domain. VirusTotal reports that 14 out of 95 security vendors flag fayavo.icu as malicious, with detections spanning phishing and generic threat categories. The domain was registered on June 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. Additionally, the domain resolves to the IP address 188.114.96.3 and is listed in one threat intelligence pulse on AlienVault OTX. The SSL certificate, issued by Google Trust Services, does not mitigate the risk, as threat actors commonly leverage trusted certificates to lend false legitimacy to phishing sites. Users who have visited fayavo.icu or entered credentials on the site should take immediate remedial actions. First, any passwords entered on the site must be changed immediately across all platforms where the same credentials are reused. Enable multi-factor authentication (MFA) on critical accounts to mitigate the risk of unauthorized access. Monitor financial and communication accounts for signs of compromise, such as unauthorized logins or messages sent without consent. If personal or financial data was exposed, consider reporting the incident to relevant authorities and credit monitoring services. Network administrators should block the domain and its associated IP address (188.114.96.3) at the perimeter to prevent further access within their environments.