facebmall[.]shop

This domain, facebmall.shop, poses a high-risk brand impersonation threat specifically targeting Apple users. Analysis indicates the site masquerades as a legitimate Apple service, likely to harvest credentials, payment details, or deploy malicious payloads under the guise of an official platform. The page title 'Facebook Shop' is anomalous for an Apple impersonation site, suggesting either misdirection or an attempt to exploit cross-platform confusion among users. The infrastructure is designed to deceive victims into believing they are interacting with a trusted brand, increasing the likelihood of successful compromise. Evidence supporting this assessment includes detection by 22 out of 95 security vendors on VirusTotal, a clear indicator of malicious intent. The domain was registered on October 28, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolves to the IP address 38.147.172.11, hosted under AS139659 (LUCIDACLOUD LIMITED) in Hong Kong, a network with a history of hosting phishing and fraudulent infrastructure. Google Safe Browsing has flagged the domain as phishing, and it appears on at least one security blocklist. Notably, the domain lacks an SSL certificate, further reducing its legitimacy and increasing the risk of man-in-the-middle attacks or data interception. Users who visited facebmall.shop should take immediate action to mitigate potential compromise. If credentials or payment information were entered, reset passwords for all associated accounts, enable multi-factor authentication where available, and monitor financial statements for unauthorized transactions. Scan the device used to access the site with updated security tools to detect any installed malware or backdoors. Report the incident to relevant fraud reporting platforms and consider notifying the impersonated brand (Apple) to aid in broader takedown efforts. Avoid interacting with any communications originating from this domain, including emails or messages, as they may contain further malicious links or social engineering attempts.