fb-helppline-service[.]vercel[.]app

The domain fb-helppline-service.vercel.app has been identified as a high-risk phishing site specifically designed to impersonate Meta (formerly Facebook) Customer Support. Analysis confirms the domain is currently offline, though it previously hosted a fraudulent login portal targeting users of the Meta platform. The threat type is classified as brand impersonation with credential harvesting capabilities, a common tactic in phishing campaigns aimed at stealing account credentials. Infrastructure analysis reveals the domain was registered through Vercel Inc. and resolved to the IP address 64.29.17.3, geolocated in the United States under AS16509 (Amazon.com, Inc.). The SSL certificate was issued by Google Trust Services (WR1), a legitimate provider often abused by threat actors to lend credibility to malicious sites. Detection metrics indicate the domain was flagged by 22 of 95 security vendors on VirusTotal, while appearing on two independent security blocklists. Google Safe Browsing also classified the domain as phishing. The page title, 'Meta Customer Support,' directly mimics official Meta branding to deceive users. Current status confirms the domain has been taken offline, though historical data suggests it may reappear under a different name or infrastructure. Organizations and users are advised to block the domain and its associated IP (64.29.17.3) at the network level. Security teams should monitor for similar patterns, including Vercel-hosted domains with Meta-related keywords, SSL certificates issued by Google Trust Services, and IP associations with AS16509. End-users should be trained to verify domain authenticity before entering credentials, particularly for support-related pages, and to report suspicious URLs to their security operations center for further analysis.