facebook-login1[.]vercel[.]app

The domain facebook-login1.vercel.app is assessed as a high-risk brand impersonation threat. This domain mimics the official Facebook login page, potentially leading users to disclose sensitive information such as login credentials and personal data.

Infrastructure analysis reveals that the domain is registered through Tucows Domains Inc. and resolves to the IP address 64.29.17.67, which is located in the United States and associated with AS16509 Amazon.com, Inc. The domain was created on February 21, 2026. As of the latest analysis, the domain is flagged by 21 out of 95 security vendors on VirusTotal, indicating a significant level of suspicion. The SSL certificate is issued by Google Trust Services / WR1, which may lend a false sense of security to unsuspecting users. The domain appears on one security blocklist and is marked as phishing by Google Safe Browsing. PhishDestroy has also blocked this domain, further confirming its malicious intent.

To mitigate the risk of brand impersonation, users are advised to verify the URL of the login page before entering any credentials. Organizations should update their security awareness training to include examples of such impersonation tactics and educate employees on the importance of recognizing and reporting suspicious login pages. Network administrators should consider implementing DNS-based blocking to prevent access to known malicious domains and regularly monitor security blocklists for updates.