facellt[.]com

facellt.com is a recently activated domain (April 13, 2025) currently under investigation for impersonating Google accounts as part of a credential harvesting campaign. This domain is suspected to host a phishing kit designed to mimic official Google login pages, tricking users into divulging authentication credentials under the guise of account verification or security alerts. The fraudulent infrastructure appears to leverage stolen branding to enhance credibility, a common tactic in generic phishing attacks targeting unsuspecting users seeking secure access to Google services. This domain resolves to IP address 188.114.96.3 and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. According to VirusTotal, the domain has not yet been flagged, with a detection score of 1 out of 95 engines. It holds a valid SSL certificate issued by Google Trust Services, which may increase user trust in the fraudulent site. PhishDestroy has identified this domain and added it to its blocklist, marking the first detection instance for this threat vector. The domain’s recent creation date and low VT score suggest an emerging threat that has not yet propagated across broader security databases. Currently, this domain remains active and poses a moderate risk despite its limited detection footprint. PhishDestroy has taken immediate countermeasures by blocking access to facellt.com, preventing users from reaching the fraudulent page. However, given the domain’s freshly registered status and the absence of widespread detection, there is a heightened risk of this phishing campaign expanding before full identification. Users are advised to scrutinize unsolicited login prompts, verify domain authenticity, and rely on established security tools such as PhishDestroy to mitigate exposure to this credential theft scheme.