wp-windowf9[.]vercel[.]app

This domain, wp-windowf9.vercel.app, operates as a high-risk Facebook credential harvesting phishing site designed to deceive users into disclosing login credentials. The page title, "네이버 : 로그인" (Naver: Login), is a deliberate attempt to mimic legitimate Korean login portals while targeting Facebook users, suggesting a localized phishing campaign. Analysis indicates the domain impersonates Facebook’s branding to exploit user trust, likely distributing stolen credentials for unauthorized account access or further malicious activities such as financial fraud or identity theft.

Infrastructure analysis reveals multiple high-confidence threat indicators. The domain was registered on March 09, 2026, through Vercel Inc., and resolves to the IP address 64.29.17.3, hosted on Amazon’s AS16509 infrastructure in the United States. VirusTotal reports 20 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing explicitly classifies it as phishing. The SSL certificate, issued by Google Trust Services (WR1), does not mitigate the threat, as phishing sites frequently use valid certificates to appear legitimate. The domain appears on one security blocklist, and despite its recent creation date, it remains actively serving malicious content.

Users who have visited wp-windowf9.vercel.app or entered credentials on the site should immediately take corrective actions. First, reset Facebook passwords using a secure device and enable multi-factor authentication (MFA) to prevent unauthorized access. Review recent account activity for signs of compromise, such as unfamiliar logins or unauthorized posts. If financial or personal information was disclosed, monitor accounts for fraudulent transactions and consider placing a fraud alert with credit bureaus. Clear browser cache and cookies to remove any residual tracking elements, and report the domain to security teams for further investigation. Organizations should update blocklists to include this domain and its associated IP address (64.29.17.3) to prevent future exposure.