p42[.]lv

This domain, p42.lv, was set up to trick people into thinking they are logging into Facebook. Instead of taking you to the real Facebook login page, it captures your email and password for cybercriminals. This type of fake login page is a classic phishing tactic, and it can lead to your account being hijacked, your personal messages exposed, and even your friends being scammed. The page title was simply "P42 -", which is a red flag because legitimate Facebook pages always display "Facebook" in the title.

PhishDestroy's analysis shows that security vendors are well aware of this threat. VirusTotal, a service that checks files and URLs against many antivirus engines, reports that 17 out of 95 security vendors flagged this domain as malicious. Additionally, AlienVault OTX, a threat intelligence platform, found p42.lv included in 16 different threat pulses, meaning it has been actively shared among security researchers. The domain also appears on two security blocklists. While the domain is currently offline and taken down, the infrastructure behind it, including the IP address 50.6.160.16 and an SSL certificate from Sectigo, could be reused for future attacks.

If you visited p42.lv and entered any information, especially your Facebook credentials, you should change your Facebook password immediately from a trusted device. Also enable two-factor authentication on your account if you haven't already. Be on the lookout for any suspicious activity on your account, such as messages you didn't send or changes to your profile. Finally, always verify the URL of any login page before typing your password. If a link seems off, go directly to Facebook's website by typing the address into your browser. For further protection, use PhishDestroy's browser extension or check any suspicious URLs on their site before clicking.