sddftyrdyfwaru[.]vercel[.]app

This domain, sddftyrdyfwaru.vercel.app, is flagged for high-risk brand impersonation targeting Facebook. Analysis of the page title confirms the fraudulent activity, with the domain explicitly mimicking Facebook's login interface to deceive users into entering credentials. No direct evidence of a crypto drainer or malware payload was observed, but the domain aligns with credential harvesting tactics commonly deployed in phishing campaigns. Infrastructure analysis reveals the domain resolves to the IP address 216.198.79.131, hosted by Vercel, Inc. in the United States. The SSL certificate is issued by Google Trust Services (WR1), a common but not inherently malicious provider. VirusTotal detection metrics show 14 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is registered through Vercel Inc., with no historical registration data publicly available. Google Safe Browsing status was not explicitly provided, but the presence on a blocklist and VirusTotal detections confirm its malicious classification. As of the latest assessment, sddftyrdyfwaru.vercel.app remains active, posing an ongoing threat to users. Response actions should include immediate blacklisting of the domain and IP across security controls, alongside monitoring for related subdomains or newly registered lookalike domains. Organizations are advised to block access to this domain at the network level and alert users to the risk of credential theft. Given the domain's persistence, continued vigilance is required, particularly for Facebook users or those accessing social media platforms via unsecured networks.