facebocks[.]com[.]vn

This domain is classified as a high-risk brand impersonation threat specifically designed to deceive users into disclosing Facebook login credentials. The infrastructure mimics legitimate Facebook properties, leveraging social engineering tactics to harvest sensitive authentication details. Analysis indicates this domain poses a significant risk to both individual users and organizational security due to its active status and targeted impersonation of a widely used social media platform. Infrastructure analysis reveals the domain facebocks.com.vn is currently active and resolves to the IP address 103.72.57.226. It is flagged by 15 out of 95 security vendors on VirusTotal, indicating broad detection across multiple threat intelligence sources. The domain appears on one security blocklist and is explicitly blocked by PhishingDB. The SSL certificate is issued by Let's Encrypt, which, while providing encryption, does not validate the legitimacy of the domain's intent. No creation date or registrar details were provided, but the domain's structure and naming convention closely resemble Facebook's branding to maximize deception. Mitigation against this credential theft threat requires immediate action. Network administrators should block the domain facebocks.com.vn and its associated IP 103.72.57.226 at the firewall or DNS level to prevent access. End-users should be educated on identifying brand impersonation tactics, such as scrutinizing domain names for misspellings or unusual top-level domains. Multi-factor authentication (MFA) should be enforced for all Facebook accounts to mitigate the impact of credential theft. Organizations should monitor for unusual login attempts originating from the identified IP address and domain, and reset credentials for any accounts that may have interacted with the malicious site. Threat intelligence teams should incorporate these indicators into their monitoring systems to detect related phishing campaigns.