facebook-clone-phi-ruddy[.]vercel[.]app

PhishDestroy has initiated an active investigation into the domain facebook-clone-phi-ruddy.vercel.app, which is currently impersonating Facebook to deceive users. This site leverages a cloned interface to harvest credentials and personal information under the guise of a legitimate social media platform. The threat actor behind this campaign is likely distributing the domain via phishing emails or malicious advertisements, capitalizing on Facebook’s widespread recognition to lower user suspicion.

Evidence supporting the malicious nature of this domain includes zero detections on VirusTotal (23/95), a Google Trust Services SSL certificate, and active flagging by Google Safe Browsing under the SOCIAL_ENGINEERING category. The domain is hosted by Vercel Inc. and resolves to the IP address 216.198.79.131. While specific registration details such as the creation date are not provided, the lack of detection despite its active impersonation tactics and Google’s blocklist status underscores the urgency of this threat.

If you or your organization have encountered this domain, avoid interacting with it and do not attempt to log in or provide any personal information. Immediately disconnect from the site and conduct a security scan on affected devices. Report the domain to your security team or through platforms like Google Safe Browsing to aid in its takedown. Users should also enable multi-factor authentication on their legitimate Facebook accounts and remain vigilant for further impersonation attempts.