kxnzmhasyqrfsvgabnqrwczdfskdfhvfs[.]rest

Analysis indicates that the domain kxnzmhasyqrfsvgabnqrwczdfskdfhvfs.rest was registered on 16 October 2025 through GoDaddy.com, LLC and resolves to the IPv4 address 162.241.123.127, which belongs to AS46606 Unified Layer in the United States. The site presented the page title “Official Support Center” and is classified as a brand‑impersonation campaign targeting Facebook. The domain appears in 15 AlienVault OTX threat‑intel pulses and is flagged by Google Safe Browsing for social‑engineering content. VirusTotal records show that 17 of 95 scanned security vendors flagged the domain as malicious, confirming its association with phishing activity.

The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy mitigation service. No TLS certificate was observed, indicating that the site operated over plain HTTP only. Infrastructure details reveal that the domain’s authoritative nameservers are sns33.hostgator.in and sns34.hostgator.in, both hosted by HostGator. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment.

Current DNS queries indicate the domain is taken offline, but the historical evidence suggests it was actively used for credential‑stealing operations against Facebook users. Defenders should continue to enforce DNS‑level blocking of the domain and the associated IP address, add the domain to internal phishing‑filter rules, and monitor for any resurgence of the same nameserver configuration or IP range. Given the presence in multiple threat‑intel feeds and the low trust rating, the domain should be treated as high‑risk and incorporated into broader brand‑impersonation detection signatures.