poly-market[.]vercel[.]app

This domain is flagged as a high-risk credential harvesting infrastructure targeting Facebook users. Analysis indicates the threat type is brand impersonation, specifically designed to mimic Facebook login portals for unauthorized credential collection. The domain remains active and poses significant risk to users and organizations relying on Facebook for authentication or business operations. Infrastructure analysis reveals the following technical indicators: poly-market.vercel.app is detected by 4 out of 95 security vendors on VirusTotal, with a creation date of February 21, 2026. The domain is registered through Tucows Domains Inc. and resolves to IP address 216.198.79.67, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. The SSL certificate is issued by Google Trust Services (WR1). The domain appears on two security blocklists, specifically PhishDestroy and Enkrypt, confirming its malicious classification. Mitigation steps should focus on credential harvesting prevention. Organizations should implement immediate DNS-level blocking of poly-market.vercel.app and its resolved IP address 216.198.79.67. Security teams should monitor for any attempts to access this domain from corporate networks and conduct user awareness training emphasizing Facebook-branded phishing risks. Multi-factor authentication should be enforced for all Facebook-related accounts to reduce the impact of potential credential compromise. Network logs should be reviewed for connections to the identified IP address or domain to identify any prior exposure.