secureid-loginca[.]com

The domain secureid-loginca.com is identified as a high-risk brand impersonation threat currently offline. Analysis confirms it specifically targets Facebook users by replicating the platform's login interface, aiming to harvest account credentials through deceptive authentication prompts. The threat type is classified as credential theft via brand impersonation, with Facebook as the confirmed target. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain was registered on June 16, 2026, through Global Domain Group LLC, an uncommon registrar for legitimate social media properties. It resolves to the IP address 157.240.8.35 and holds a Gridinsoft trust score of 0/100. Security vendor detection on VirusTotal shows 10 of 95 engines flagging the domain as malicious. The domain appears on three distinct security blocklists and is actively blocked by at least three security providers, including MetaMask and PhishDestroy. The page title precisely matches Facebook's legitimate login portal: 'Facebook – log in or sign up.' Current status indicates the domain has been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Organizations and individuals are advised to implement the following mitigations: (1) Add the domain to internal blocklists to prevent future access attempts; (2) Monitor network logs for connections to 157.240.8.35 or related subdomains; (3) Educate users on recognizing brand impersonation tactics, particularly login page replication; (4) Enforce multi-factor authentication to mitigate credential theft impact; (5) Report the domain to relevant security communities for broader awareness. The creation date discrepancy (2026) suggests potential domain squatting or pre-registration for malicious campaigns, warranting continued monitoring of this infrastructure.