facebook-feed5942[.]rollout[.]site

The domain facebook-feed5942.rollout.site has been identified as a brand impersonation threat targeting Facebook. Analysis confirms the domain was actively spoofing Facebook's interface, presenting a page titled 'Facebook Feed - Social Media Dashboard' to deceive users. The domain is currently offline, but prior activity aligns with credential harvesting or social engineering campaigns. Infrastructure analysis reveals the domain was registered on October 24, 2024, through NameCheap, Inc. and resolved to the IP address 37.72.169.170, hosted under AS29802 (HIVELOCITY, Inc.) in the United States. Security vendors flagged the domain in 17 of 95 VirusTotal scans, and it appears on two security blocklists, including PhishDestroy and PhishingDB. The SSL certificate was issued by SSL2BUY EMEA LLC, a common provider for both legitimate and malicious domains, which does not inherently indicate trustworthiness. The domain's current offline status suggests takedown action or voluntary suspension by the threat actor. However, the infrastructure remains a potential risk for re-emergence under a similar naming scheme. Organizations and users are advised to block the domain and its associated IP at the network level, monitor for related subdomains or typosquatting variants, and review logs for prior connections to 37.72.169.170. Security teams should prioritize awareness training to educate users on recognizing brand impersonation tactics, particularly those mimicking social media dashboards or login portals.