facebook-clone-eta[.]vercel[.]app

This domain is flagged as a high-risk brand impersonation threat specifically targeting Facebook users. Analysis indicates the site is designed to mimic legitimate Facebook login pages, likely aiming to harvest user credentials through deceptive authentication prompts. The threat type is classified as credential theft via brand impersonation, with no indications of crypto-drainer functionality or other payload delivery mechanisms at this time. Infrastructure analysis reveals the domain facebook-clone-eta.vercel.app was registered on June 08, 2026, through Vercel's hosting platform. The domain is currently active and appears on one security blocklist. VirusTotal detection metrics show 21 out of 95 security vendors flagging this domain as malicious. The domain resolves to Vercel's infrastructure, with no unique IP address attribution beyond standard Vercel hosting patterns. Creation date anomalies suggest potential domain squatting or rapid deployment for malicious purposes. Mitigation requires immediate blocking of facebook-clone-eta.vercel.app at network perimeter and endpoint levels. Security teams should implement DNS sinkholing for the domain and monitor for any connections to it across enterprise systems. User awareness training should emphasize verification of Facebook login page URLs, particularly for domains hosted on third-party platforms like vercel.app. Organizations should review authentication logs for any successful or attempted logins originating from this domain and reset credentials for affected accounts. Additional monitoring should be implemented for any secondary domains registered through Vercel that may follow similar naming patterns.