facebook-one-psi[.]vercel[.]app

This domain, facebook-one-psi.vercel.app, is flagged as a high-risk brand impersonation threat specifically targeting Facebook users. Analysis indicates the site was engineered to deceive visitors into believing they are interacting with legitimate Facebook infrastructure, likely with the intent of harvesting login credentials or distributing malicious payloads. The threat type is classified as brand impersonation, a tactic commonly used to exploit user trust in recognized brands for fraudulent activities such as credential theft or account takeover. Infrastructure analysis reveals multiple critical indicators of compromise. The domain was registered through Tucows Domains Inc. on February 21, 2026, though the creation date appears anomalous and may suggest domain spoofing or backdating. It resolves to IP address 64.29.17.67, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. The site is currently offline, displaying a 'Deployment Unavailable' page title, which may indicate temporary takedown or evasion tactics. Security validation shows 17 out of 95 vendors on VirusTotal flagging the domain as malicious, while it appears on two security blocklists: PhishDestroy and PhishingDB. Google Safe Browsing further confirms the phishing classification. The SSL certificate is issued by Google Trust Services (WR1), a detail that threat actors often exploit to lend false legitimacy to malicious sites. Mitigation steps specific to this brand impersonation threat include immediate blocking of the domain and its associated IP address across all network security controls. Organizations should update endpoint detection rules to flag any attempts to access facebook-one-psi.vercel.app or its resolved IP. Security teams are advised to conduct a retrospective analysis of network logs for connections to 64.29.17.67 or related subdomains, particularly focusing on sessions involving Facebook authentication flows. User awareness training should emphasize the risks of brand impersonation, highlighting red flags such as unusual domain structures (e.g., 'facebook-one-psi') and SSL certificates issued to third-party providers rather than the legitimate brand. Additionally, monitoring for newly registered domains with similar naming patterns or hosting on Vercel infrastructure can help preempt future threats targeting the same brand.