aivideo[.]sellit[.]name[.]ng

This domain, aivideo.sellit.name.ng, is actively engaged in brand impersonation targeting Facebook, a high-risk threat vector designed to deceive users into disclosing credentials or installing malicious software. The site presents itself under the guise of "AI Videos," a tactic commonly used to exploit trust in legitimate platforms by mimicking their branding, language, or service offerings. Brand impersonation domains like this are frequently leveraged in credential harvesting campaigns, where victims are lured into entering login details on fraudulent pages that closely resemble the authentic service. Given the domain’s association with Facebook, a platform with over 3 billion active users, the potential impact of such impersonation is substantial, particularly for users unaware of the deception. Infrastructure analysis reveals several concrete indicators of malicious activity. The domain was registered on June 13, 2025, through HostAfrica, and resolves to the IP address 163.61.188.222, hosted under AS153568 (NEW DHAKA HARDWARE) in the United States. Notably, the domain lacks a valid SSL certificate, a critical red flag for any site handling user data, as it indicates an absence of encryption for transmitted information. VirusTotal detection shows that 1 out of 95 security vendors has flagged the domain as malicious, while PhishDestroy has explicitly blocked it. Additionally, the domain appears on one security blocklist, further corroborating its classification as a high-risk entity. The combination of these factors—recent registration, lack of encryption, and minimal but confirmed detection—strongly suggests the domain is part of a coordinated impersonation campaign. Users who have visited aivideo.sellit.name.ng should take immediate action to mitigate potential risks. First, any credentials entered on the site must be considered compromised and should be changed immediately on the legitimate Facebook platform, ideally using a device not previously used to access the fraudulent domain. Second, users should scan their devices for malware, as impersonation sites often deploy malicious scripts or payloads. Third, monitor financial and account activity for unauthorized transactions or changes, particularly if payment details were entered. Finally, report the domain to relevant security teams or platforms to aid in takedown efforts and prevent further victimization. Given the domain’s active status, continued vigilance is advised, and users should avoid interacting with it or any associated links.