facebooken[.]login[.]piotrpiotr[.]pl

This domain is flagged as an elevated-risk phishing site specializing in brand impersonation targeting OKX, a cryptocurrency exchange. The threat involves a fake login portal designed to harvest credentials, potentially leading to unauthorized account access or financial theft. The page title 'Strona logowania - Edukacja PoC' suggests an attempt to masquerade as an educational or proof-of-concept resource, though infrastructure analysis confirms malicious intent. Analysis indicates the domain was registered on October 31, 2025, through DOMENY.TV MSERWIS Sp. z o.o., a registrar based in Poland. It resolves to IP address 46.248.187.185, hosted on AS47544 (IQ PL Sp. z o.o.). VirusTotal reports 25 out of 95 security vendors flagging the domain as malicious, while PhishDestroy has listed it on one blocklist. The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious sites due to its free and automated issuance process. The domain has since been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Mitigation steps for organizations and end-users include immediate blacklisting of the domain and its associated IP (46.248.187.185) at the network perimeter. Users who accessed the site should assume credential compromise and initiate password resets for OKX and any other accounts where identical credentials were reused. Security teams should monitor for follow-up phishing campaigns leveraging similar subdomain patterns (e.g., brandname.login.[random].pl) or registrars with low verification thresholds. Cryptocurrency exchanges and financial platforms are advised to implement multi-factor authentication (MFA) enforcement and domain-based email filtering to block lookalike sender addresses. Post-incident, affected users should review account activity for unauthorized transactions or configuration changes.