sunvera[.]sbs

This domain is flagged as a high-risk phishing threat specializing in fake login page impersonation targeting Messenger users. Analysis indicates the site is designed to harvest credentials by mimicking legitimate authentication portals, a common tactic for account takeover and subsequent fraud or malware distribution. Infrastructure analysis reveals the domain sunvera.sbs was registered on June 25, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It currently resolves to IP address 104.21.26.71. VirusTotal detection shows 13 out of 95 security vendors have flagged this domain as malicious. The domain appears in two threat intelligence pulses on AlienVault OTX, confirming its active use in phishing campaigns. The page title 'Messenger' further corroborates the impersonation of the popular messaging platform. Organizations and users should implement the following mitigation steps: block the domain sunvera.sbs and its resolving IP 104.21.26.71 at firewall and DNS levels. Security teams should update email filtering rules to quarantine messages containing links to this domain. End-users who may have interacted with the site should immediately reset their credentials using multi-factor authentication and monitor accounts for unauthorized activity. Network administrators are advised to review logs for connections to the domain or IP to identify potentially compromised systems.