numiva[.]xyz

This domain, numiva.xyz, is flagged as an active phishing infrastructure specifically targeting users of Facebook Messenger. Analysis indicates the site mimics legitimate Messenger login pages to harvest credentials, posing a high risk of account compromise. The domain remains operational and continues to resolve to its hosting infrastructure. Infrastructure analysis reveals the domain was registered on June 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, an unusual creation date that may indicate domain spoofing or backdating. It resolves to IP address 172.67.145.167 and uses an SSL certificate issued by Google Trust Services (WE1). Security vendor detection is notable: 13 of 95 VirusTotal engines flag the domain as malicious, and it appears on one security blocklist. The page title explicitly displays 'Messenger,' reinforcing its impersonation of the legitimate platform. Current status confirms the domain remains active and unresolved by registrars or hosting providers. Organizations and end users are advised to block resolution to 172.67.145.167 at the network perimeter and update endpoint protection rules to include numiva.xyz in phishing domain blacklists. Security teams should monitor for credential submission attempts originating from this domain and initiate password resets for any accounts potentially exposed. The anomalous creation date (2026) should be treated as a red flag for automated detection systems.