facebook-login-page-kappa[.]vercel[.]app

Facebook-login-page-kappa.vercel.app is an active phishing domain impersonating Facebook to harvest user credentials. Despite its cloaking score of 1/10, which indicates it serves benign content to automated scanners, the domain has been flagged as malicious by 11 out of 91 vendors on VirusTotal. This suggests that the domain is effectively evading detection by some security solutions while still being recognized by others.

The domain is hosted on an IP address associated with Amazon.com, Inc., located in the United States, and is registered through Vercel Inc. It uses an SSL certificate issued by Google Trust Services, which may give it an appearance of legitimacy to unsuspecting users. The site currently displays a generic page titled 'Create Next App', which is a common tactic used by phishing sites to mask their true intent from automated scanning tools.

PhishDestroy and OpenPhish have both included this domain in their public blocklists, indicating a recognized threat level. With a platform risk score of 100/100, this domain poses a significant risk for users who may be deceived by its appearance and inadvertently provide their Facebook login credentials. The early detection by PhishDestroy on June 21, 2026, highlights the importance of identifying such threats swiftly to mitigate potential damage. This case underscores the ongoing challenges in cybersecurity, where phishing domains continually adapt to evade detection.