facedook[.]services

This domain, facedook.services, is identified as a high-risk brand impersonation phishing site targeting Facebook users. The infrastructure mimics Facebook’s login and security verification pages, as evidenced by the page title 'Security Check,' which aligns with common social media phishing tactics designed to harvest credentials. No crypto drainer or secondary payload delivery was observed, but the site’s design and structure are consistent with credential theft operations. Analysis indicates the domain was registered on March 10, 2026, and resolves to IP address 43.205.243.177, hosted on Amazon Web Services infrastructure (AS16509) in India. The domain lacks an SSL certificate, increasing the likelihood of interception or detection by network security tools. VirusTotal reports 26 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing explicitly classifies it as phishing. The domain appears on one security blocklist, and no additional subdomains or associated infrastructure were identified during investigation. As of the latest verification, facedook.services has been taken offline, likely due to enforcement actions or hosting provider intervention. However, the domain’s registration remains active, posing a residual risk of reactivation or migration to alternative infrastructure. Users who accessed the site prior to takedown may remain vulnerable to credential compromise. Organizations are advised to monitor for related domains using the seed 'ac94de' and implement strict filtering for unencrypted HTTP traffic to domains impersonating social media platforms.