mfacebook[.]vn

This domain, mfacebook.vn, is identified as a brand impersonation threat targeting Facebook users. The site mimics legitimate Facebook login portals to deceive visitors into entering their account credentials, which are then captured by threat actors. Such attacks are commonly used to gain unauthorized access to personal accounts, spread malware, or conduct further fraudulent activities, including financial scams or identity theft. The risk is particularly elevated for users who may not recognize subtle differences in the domain name or page design, leading to unintended disclosure of sensitive information. Analysis indicates that mfacebook.vn is flagged by 17 out of 95 security vendors on VirusTotal, a clear indicator of its malicious nature. The domain resolves to the IP address 202.92.4.182, which is associated with the autonomous system AS135905 (VIETNAM POSTS AND TELECOMMUNICATIONS GROUP). Additionally, the domain appears on two security blocklists, including PhishDestroy and PhishingDB, further corroborating its classification as a phishing threat. While the domain is currently offline, its prior activity and infrastructure suggest it was actively used for credential harvesting campaigns targeting Vietnamese users. If you or someone you know visited mfacebook.vn and entered login credentials, immediate action is required to mitigate potential damage. First, change the password for the affected Facebook account and enable multi-factor authentication if not already active. Review the account for any unauthorized activity, such as unfamiliar posts, messages, or linked applications. Additionally, check connected devices and log out of any sessions that appear suspicious. Users should also monitor other accounts that may share the same or similar passwords, as compromised credentials are often reused across multiple platforms. Finally, consider reporting the incident to the platform’s security team to assist in broader threat mitigation efforts.