vurvoti[.]cfd

This domain, vurvoti.cfd, is identified as a fake login page impersonating Meta’s Messenger platform. Analysis confirms its current status as active, with infrastructure designed to harvest user credentials through deceptive authentication prompts. The threat type is classified as brand impersonation phishing, specifically targeting Messenger users to extract login details. Infrastructure analysis reveals the domain was registered on June 25, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 188.114.97.3 and has been flagged by 15 of 95 security vendors on VirusTotal. The domain appears on one security blocklist and is referenced in one AlienVault OTX threat intelligence pulse. The page title explicitly displays 'Messenger,' reinforcing its fraudulent intent to mimic the legitimate service. The domain remains active and poses a high risk to users. Organizations and individuals are advised to block the domain and its associated IP at the network level. End-users should be alerted to verify URLs before entering credentials, particularly for platforms like Messenger. Security teams should monitor for related domains registered under the same registrar or resolving to the same IP, as these may indicate further phishing campaigns.