mexswin-z9[.]top

This domain, mexswin-z9.top, poses a specific threat of brand impersonation targeting Facebook. The page title 'Mexswin' mimics a legitimate Facebook login interface, designed to harvest user credentials through fake sign-in forms. The domain employs Google Sign-in and reCAPTCHA technologies to appear authentic, increasing the likelihood of user deception. Its use of Cloudflare and HTTP/3 suggests an attempt to evade detection and maintain reliability during phishing campaigns.

Technical indicators confirm the malicious nature of this domain. VirusTotal reports 6 out of 95 security vendors flagging the domain as malicious, indicating moderate but significant detection across the security community. The domain was registered on December 29, 2024, through NameSilo, LLC, a registrar known for minimal abuse screening. It resolves to IP address 188.114.97.3, hosted by Cloudflare, and currently appears on 1 security blocklist. The Gridinsoft trust score is 0 out of 100, reflecting zero trustworthiness. The SSL certificate is issued by Google Trust Services, which is commonly used for legitimate sites but here is misused for fraudulent purposes.

Users who have visited mexswin-z9.top should immediately change their Facebook passwords and enable two-factor authentication on their accounts. They should scan their devices for malware or keyloggers that may have been deployed during the visit. Any credentials entered on this domain should be considered compromised, and users should monitor their Facebook accounts for unauthorized activity. Reporting the domain to Facebook's phishing team and local cybersecurity authorities is also recommended to aid in takedown efforts.