facebook-sigma-ruby[.]vercel[.]app

This domain, facebook-sigma-ruby.vercel.app, is actively flagged as a high-risk brand impersonation site targeting Facebook. Infrastructure analysis reveals it is hosted on Vercel and resolves to IP 64.29.17.3, associated with Vercel, Inc. in the US. The domain returns an HTTP 200 status, indicating an operational webpage, and its page title explicitly displays 'Facebook,' aligning with the known scam type of brand impersonation. The SSL certificate is issued by Google Trust Services (WR1), which does not inherently indicate malicious activity but is consistent with phishing domains leveraging legitimate certificate authorities. As of July 19, 2026, the domain is detected by 18 of 91 security vendors on VirusTotal and appears on at least one security blocklist, including PhishDestroy. While the exact content of the page remains unanalyzed, the combination of its title, hosting provider, and detection by multiple security tools strongly suggests it is designed to deceive users into believing it is an official Facebook login portal. Defenders should treat this domain as malicious, block access at the network level, and monitor for related indicators of compromise, such as user reports of credential theft or unauthorized account access linked to this URL. Further investigation into the domain's registration details and any associated email or payment infrastructure may provide additional context for takedown efforts.