facebook-feedback9hqg[.]rollout[.]site

This domain, facebook-feedback9hqg.rollout.site, poses a brand impersonation threat designed to deceive users into believing they are interacting with an official Facebook feedback portal. The page title, 'Facebook Feedback - Share Your Experience,' mimics legitimate user engagement platforms, increasing the likelihood of credential harvesting or personal data exfiltration. Analysis indicates the domain was crafted to exploit trust in the Facebook brand, potentially targeting users through phishing emails, social media links, or malvertising campaigns. Infrastructure analysis reveals the domain was registered on October 24, 2024, through NameCheap, Inc., a registrar frequently associated with malicious activity due to its accessibility and low-cost domain services. The domain resolves to the IP address 37.72.169.170, hosted under AS29802 (HIVELOCITY, Inc.) in the United States. Security vendor detections on VirusTotal report 17 out of 95 engines flagging the domain as malicious, while it appears on two independent security blocklists. The SSL certificate, issued by SSL2BUY EMEA LLC, provides encryption but does not validate legitimacy, as certificates are easily obtainable for malicious domains. Users who visited facebook-feedback9hqg.rollout.site should assume their credentials or personal information may have been compromised. Immediate actions include resetting passwords for Facebook and any accounts where identical credentials were reused, enabling multi-factor authentication, and monitoring financial or social media accounts for unauthorized activity. System scans using updated security tools are recommended to detect potential malware or backdoors. Organizations should update internal blocklists to include this domain and its associated IP address to prevent further exposure.