post-rose[.]vercel[.]app

This domain, post-rose.vercel.app, is actively engaged in brand impersonation targeting Facebook users through a fraudulent Help Centre interface. Analysis indicates the page is designed to harvest login credentials by mimicking Facebook's official support portal, presenting a high-risk threat to unsuspecting visitors. The campaign leverages social engineering tactics, including urgency and familiarity, to trick users into entering sensitive account details, which are then captured by the attackers for unauthorized access or further exploitation. Infrastructure analysis reveals the domain was created on April 09, 2026, and is hosted on Vercel Inc.'s platform, resolving to the IP address 216.198.79.195 located in the United States. Security vendor detections on VirusTotal report 17 out of 95 engines flagging the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Google Trust Services under the WR1 intermediate, a common certificate authority for legitimate and malicious domains alike. The domain is registered through Vercel Inc., a hosting provider frequently abused for phishing due to its ease of deployment and free tier availability. Users who have visited post-rose.vercel.app or interacted with the fake Help Centre page should immediately take remedial actions. First, reset Facebook account passwords using a secure device and enable multi-factor authentication if not already active. Review recent account activity for unauthorized logins or changes, and revoke access for any unfamiliar applications or sessions. Monitor linked email accounts for suspicious password reset requests or phishing attempts. If financial or personal data was entered, consider placing a fraud alert with credit bureaus and reporting the incident to relevant cybersecurity authorities. Organizations should update web filters to block this domain and its associated IP address to prevent further exposure.