heu-ai[.]top

This domain, heu-ai.top, is flagged as a brand impersonation threat specifically targeting Facebook. Analysis indicates the infrastructure was designed to mimic legitimate Facebook login interfaces, likely for credential harvesting purposes. The page title explicitly displays 'Facebook,' reinforcing the social engineering component of this campaign. No crypto drainer functionality was observed in available telemetry, though credential theft remains the primary objective. Infrastructure analysis reveals the domain was registered on April 8, 2026, through Gname.com Pte. Ltd., an uncommon registrar for legitimate social media properties. The domain resolves to IP address 107.149.129.197, which has no prior association with Facebook's official infrastructure. Security vendor detection rates show 18 out of 95 engines flagging the domain as malicious on VirusTotal. Gridinsoft assigned a trust score of 0/100, and the domain appears on one security blocklist. Notably, the creation date being in the future suggests either a data entry error or an attempt to evade temporal-based detection mechanisms. Current status indicates the domain has been taken offline, though residual risk persists. The hosting IP and registrar remain active, potentially enabling threat actors to redeploy similar infrastructure. Response actions appear to have included domain suspension and blocklist inclusion, though no public takedown notice was observed. Users who interacted with this domain should immediately reset Facebook credentials from a verified device, enable multi-factor authentication, and monitor connected applications for unauthorized access. Organizations should update security controls to detect similar impersonation patterns, particularly domains using hyphenated brand names and future-dated registrations.