launchpad-nextjs-typescript-facebook-clone[.]vercel[.]app

Analysis of the domain launchpad-nextjs-typescript-facebook-clone.vercel.app indicates a high-risk brand impersonation campaign targeting Facebook users. The domain was registered on March 11, 2026, through Vercel, a platform commonly used for hosting static and dynamic web applications. Infrastructure analysis reveals the domain resolves to IP address 64.29.17.195, associated with AS16509 (Amazon.com, Inc.) and located in the United States. The SSL certificate is issued by Google Trust Services, a detail consistent with legitimate sites but frequently exploited in phishing operations to appear credible. Detection data shows the domain is flagged by 16 of 94 security vendors on VirusTotal, a notable indicator of malicious activity. Additionally, it appears on one security blocklist (PhishDestroy) and has received a trust score of 1/100 from Scamadviser and 0/100 from Gridinsoft, further corroborating its classification as a phishing threat. The domain remains active as of July 12, 2026, returning an HTTP 200 status, which suggests the campaign is operational. The domain name itself contains explicit references to Facebook, alongside technical terms (Next.js, TypeScript) likely intended to lend an appearance of legitimacy or to evade basic keyword-based filters. No specific phishing kit or payload has been confirmed at this stage, and the exact content of the site remains unanalyzed. Defenders are advised to treat this domain as an active threat, block it at the network level, and monitor for related infrastructure, particularly subdomains or IPs within the same ASN. Given the domain's recent registration and persistent activity, continued vigilance is recommended.