mexswinc[.]top

This domain, mexswinc.top, poses as a legitimate Facebook login portal to deceive users into entering their credentials. The site is designed to harvest account details, potentially leading to unauthorized access, account takeovers, or further malicious activity such as spreading scams or malware through compromised profiles. Users who interact with this site risk exposing sensitive personal and financial information linked to their Facebook accounts. Analysis indicates mexswinc.top was registered on December 29, 2024, through NameSilo, LLC, a registrar frequently associated with newly created phishing domains. The domain is flagged by 4 out of 95 security vendors on VirusTotal, including detection as a brand impersonation threat. Infrastructure analysis reveals the site uses Cloudflare (resolving to IP 172.67.188.31) and employs Google Sign-in, reCAPTCHA, and Google Analytics—common techniques to appear legitimate while evading detection. The page title 'Mexswin' and the use of Google Trust Services for SSL further mask its malicious intent. If you visited mexswinc.top or entered credentials on this site, immediately change your Facebook password and enable multi-factor authentication. Review your account for unauthorized activity, such as unfamiliar posts, messages, or linked apps. Check connected devices and log out of any unrecognized sessions. Monitor linked email accounts for suspicious password reset attempts or login alerts. If financial information was entered, contact your bank or payment provider to secure accounts. Report the incident to Facebook’s security team and consider running a malware scan on devices used to access the site.