review-unusual-signin-activity[.]live

This domain is flagged for elevated risk due to brand_impersonation, specifically targeting Facebook credentials. Analysis indicates the domain mimics legitimate Facebook login pages to harvest user authentication details, posing a direct threat to account security and data integrity. Infrastructure analysis reveals the domain review-unusual-signin-activity.live was registered on December 24, 2025, through Name.com, Inc. It resolves to IP address 3.238.111.50, hosted on infrastructure belonging to Amazon.com, Inc. (AS14618) in the United States. The domain lacks an SSL certificate, increasing exposure to interception. Security vendors on VirusTotal flagged this domain at a rate of 17/95, while it appears on one security blocklist. The page title, 'Facebook – log in or sign up,' confirms the impersonation attempt. Mitigation requires immediate blocking of the domain and its associated IP (3.238.111.50) at network perimeter defenses. Organizations should deploy indicators of compromise (IOCs) to endpoint detection systems and conduct retrospective log analysis for connections to the domain. User awareness training should emphasize verification of domain authenticity before entering credentials, particularly for login portals. Security teams are advised to monitor for anomalous authentication attempts originating from internal networks.