facenes1t[.]top

The domain facenes1t.top is identified as a brand impersonation phishing site targeting Apple Inc. Analysis confirms the domain is designed to deceive users by masquerading as an official Apple service, likely to harvest credentials, payment details, or distribute malicious payloads. The page title, 'Facebook Shop,' suggests an attempt to blend phishing content with seemingly legitimate e-commerce activity, a tactic commonly observed in fraudulent campaigns. The domain is currently offline, but its infrastructure and historical activity warrant close scrutiny. Infrastructure analysis reveals the domain was registered through NameSilo, LLC, on December 15, 2025, an unusually future-dated creation timestamp that may indicate an error or deliberate obfuscation. It resolves to the IP address 149.88.94.71, hosted in Hong Kong under AS137899 (I LAYER LIMITED), a network segment frequently associated with malicious activity. Security vendors have flagged the domain in 19 of 95 VirusTotal scans, with one confirmed blocklist entry. The SSL certificate, classified as R13, further indicates low trust, as this type of certificate is often used in short-lived or disposable phishing campaigns. The combination of these technical indicators—registrar, IP reputation, blocklist presence, and vendor detections—strongly supports the classification of facenes1t.top as a high-risk impersonation threat. As of the latest assessment, facenes1t.top has been taken offline, likely due to enforcement actions or hosting provider intervention. However, the domain remains a potential risk due to its registration status and historical malicious activity. Organizations and users are advised to block the domain at the DNS or network level to prevent accidental access. Security teams should monitor for related infrastructure, such as subdomains or newly registered lookalike domains, which may emerge as part of the same campaign. If credentials or sensitive data were entered on this site, immediate password resets and multi-factor authentication enforcement are recommended. Proactive threat hunting for indicators of compromise, including the IP address 149.88.94.71 and associated SSL certificate fingerprints, should be conducted to identify any residual exposure.