www-mfacebook[.]com[.]vn

This domain, www-mfacebook.com.vn, is identified as a brand impersonation threat targeting Facebook. Analysis indicates the infrastructure was designed to mimic the legitimate Facebook platform, likely to deceive users into disclosing credentials or other sensitive information. No direct evidence of a crypto drainer kit was observed, but the domain’s structure and naming convention strongly suggest intent to exploit trust in the Facebook brand for fraudulent purposes. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 19 out of 95 security vendors on VirusTotal, with a Let’s Encrypt SSL certificate (R13) issued for encryption. It resolves to the IP address 157.66.27.200, hosted under AS149107 (TRUMVPS COMPANY LIMITED) in Vietnam. The domain was registered on February 21, 2026, and appears on one security blocklist. Google Safe Browsing (GSB) does not currently list the domain, though this may reflect its offline status rather than an absence of malicious activity. As of the latest assessment, www-mfacebook.com.vn has been taken offline, reducing immediate exposure risk. However, the domain’s registration remains active, and the infrastructure could be reactivated or repurposed. Users who may have interacted with the domain are advised to reset credentials for any accounts accessed during the period of activity, particularly Facebook-related logins. Organizations should monitor for similar impersonation domains leveraging the same hosting provider or SSL certificate authority, as these may indicate broader campaign patterns. The elevated risk designation reflects the potential for future misuse despite the current offline status.