mtxaccshomecnfrm0log[.]github[.]io

The domain mtxaccshomecnfrm0log.github.io is currently active and engaged in brand impersonation targeting Facebook. Analysis indicates this infrastructure is designed to deceive users into disclosing login credentials under the guise of a legitimate Facebook service, specifically mimicking a "Community Standard" enforcement page. The domain remains operational despite its malicious intent, posing a significant risk to unsuspecting users. Infrastructure analysis reveals the domain is registered through GitHub, Inc. and resolves to the IP address 185.199.110.153, hosted on AS54113 (Fastly, Inc.) in the United States. Security vendors have flagged this domain as malicious, with 21 of 95 VirusTotal engines detecting it as phishing-related. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and is explicitly labeled as phishing by Google Safe Browsing. The SSL certificate is issued by Let's Encrypt (R12), a common tactic to lend superficial legitimacy to malicious sites. The page title, "Community Standard," closely aligns with Facebook’s branding, further reinforcing the impersonation attempt. As of the latest assessment, mtxaccshomecnfrm0log.github.io remains active and continues to host its fraudulent content. Organizations and individuals are advised to block this domain at the network level and update endpoint protection rules to include its IP address (185.199.110.153). Users who may have interacted with this domain should immediately reset their Facebook credentials and enable multi-factor authentication. Security teams are encouraged to monitor for additional domains hosted on the same IP or registered through GitHub Pages, as this infrastructure may be part of a broader campaign.