facebookform[.]vercel[.]app

This domain facebookform.vercel.app is assessed as a high-risk brand impersonation phishing endpoint targeting Facebook users. Analysis indicates it is designed to mimic Facebook-related form workflows, likely to trick users into submitting login credentials or sensitive account information. The observed page title 'Testing Forms' suggests a decoy interface commonly used in phishing kits to simulate legitimate form testing environments while masking credential capture functionality. The domain is currently active and continues to present exposure risk.

Evidence supports malicious classification across multiple telemetry sources. VirusTotal reports 16/95 security vendors flagging the domain as malicious. The domain is registered through Vercel Inc. and resolves to IP 64.29.17.131 hosted in the United States under Vercel infrastructure. It appears on 1 security blocklist and is protected by SSL issued by Google Trust Services / WR1. The domain specifically impersonates Facebook, increasing the likelihood of user trust exploitation and credential harvesting attempts.

The domain remains active, indicating ongoing risk of user exposure. Users who interacted with this site should assume potential credential compromise, especially if Facebook credentials were entered. Immediate mitigation includes password reset, session invalidation across devices, and enabling multi-factor authentication. Any reused credentials should be changed across all services. Security teams should monitor for unauthorized login attempts and block the domain at network and DNS layers. Endpoint checks should be performed to ensure no token theft or browser-based persistence mechanisms are present.