dazzling-pithivier-7c97c9as[.]netlify[.]app

This domain, dazzling-pithivier-7c97c9as.netlify.app, is identified as an active brand impersonation threat targeting Facebook users. Analysis indicates the site is designed to harvest login credentials through a fraudulent interface mimicking the legitimate Facebook platform. The page title explicitly displays 'Facebook,' and the infrastructure is configured to deceive users into submitting sensitive authentication details to unauthorized third parties. No evidence of a cryptocurrency drainer kit or wallet interaction was observed, focusing the threat solely on credential theft. Infrastructure analysis reveals the domain is registered through Netlify and resolves to the IP address 98.84.224.111, hosted on Amazon.com, Inc. (AS14618) infrastructure in the United States. The domain appears on two security blocklists and is flagged by 19 out of 95 security vendors on VirusTotal. Google Safe Browsing categorizes this domain as a phishing threat, and it is actively blocked by at least two security tracking systems. The SSL certificate is issued by DigiCert Inc, specifically under the DigiCert Global G2 TLS RSA SHA256 2020 CA1 intermediate, which does not mitigate the malicious intent of the site. As of the latest assessment, the domain remains active and continues to pose a high risk to users. Immediate response actions include reporting the domain to hosting providers and security organizations for takedown, as well as updating blocklists to prevent further access. Users are advised to avoid interacting with the domain and to verify the authenticity of any login page before entering credentials. Organizations should monitor for compromised accounts linked to this phishing campaign and enforce multi-factor authentication to mitigate potential unauthorized access.