revvaci[.]cfd

This domain is flagged under investigation for hosting a fake Messenger login portal designed to harvest user credentials. Analysis indicates a targeted phishing campaign impersonating legitimate authentication interfaces, likely to capture account details for unauthorized access or secondary fraud operations. The specific threat type is credential phishing with a focus on social media account compromise. Infrastructure analysis reveals the domain revvaci.cfd was registered on June 25, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It currently resolves to IP address 104.21.63.220, a Cloudflare proxy endpoint that obscures the true hosting origin. VirusTotal reports 0/95 detection flags at the time of assessment, suggesting the domain has not yet been widely flagged by security vendors. No entries are present on major blocklists, and trust scores remain neutral due to limited exposure. The page title 'Messenger' aligns with the impersonation theme, reinforcing the credential theft objective. Mitigation requires immediate action from network defenders and end users. Organizations should block the domain revvaci.cfd and its resolving IP 104.21.63.220 at perimeter security controls, including firewalls, email gateways, and DNS filters. End users should be alerted to verify URL authenticity before entering credentials, particularly on pages mimicking Messenger login flows. Security teams are advised to monitor for connections to 104.21.63.220 in proxy logs and investigate any authentication attempts originating from this domain. Given the domain's recent registration and lack of prior detection, proactive hunting for related infrastructure is recommended to preempt further abuse.