fbcloned[.]vercel[.]app

This domain, fbcloned.vercel.app, operates as a credential theft infrastructure specifically designed to impersonate Facebook's login interface. Analysis of the page title, 'Facebook Login - Clone,' confirms the intent to deceive users into submitting their authentication credentials, which are then harvested by threat actors for unauthorized account access or further malicious activities such as financial fraud or lateral movement within compromised networks.

Infrastructure analysis reveals multiple indicators of compromise. The domain is registered through Vercel Inc. and resolves to the IP address 64.29.17.131, located in the United States. It was created on May 14, 2026, an anomalous future date suggesting potential domain spoofing or misconfiguration. Security vendors on VirusTotal flag this domain at a rate of 17/95, and it appears on one security blocklist, indicating a recognized threat. The SSL certificate, issued by Google Trust Services (WR1), does not mitigate the risk, as the domain remains actively engaged in malicious activity.

Users who have interacted with fbcloned.vercel.app should immediately revoke any entered credentials by changing their Facebook password and enabling multi-factor authentication. Devices used to access the domain should undergo a full security scan to detect potential malware or unauthorized access. Network administrators are advised to block the domain and its resolving IP address at the perimeter level to prevent further exposure. Monitoring for unusual account activity, such as unauthorized logins or password reset attempts, is strongly recommended for affected individuals.