facebook[.]gapesta[.]my[.]id

This domain, facebook.gapesta.my.id, has been confirmed as a high-risk credential harvesting site specifically targeting Facebook users. Analysis indicates the site employs brand impersonation techniques to deceive visitors into submitting login credentials, payment details, or other sensitive personal information. The domain mimics Facebook's visual design and URL structure, increasing the likelihood of successful social engineering attacks against unsuspecting users. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification of this domain. The domain resolves to the IP address 128.199.207.95, hosted by DigitalOcean, LLC in Singapore. It is flagged by 24 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly categorizing it as phishing. The domain appears on one security blocklist and has been taken offline following detection. The SSL certificate is issued by Let's Encrypt (identifier E7), a common choice among threat actors due to its accessibility and short-lived validity periods. The registrar details for the my.id second-level domain remain consistent with other observed phishing campaigns targeting social media platforms. Users who may have visited facebook.gapesta.my.id or entered credentials on the site should take immediate remedial action. All passwords associated with the impersonated Facebook account must be changed without delay, using a unique, complex passphrase. Multi-factor authentication should be enabled on the account to prevent unauthorized access. Users are advised to review their account activity for any unauthorized logins, posts, or messages sent from their profile. Financial institutions should be contacted if payment details were submitted. Monitoring for identity theft and unauthorized account creation is recommended, as harvested credentials are frequently sold or used in subsequent attacks.